Security

• The site is served only over HTTPS, with HTTP Strict Transport Security and standard browser security headers.
• Form submissions are stored in a database that is not publicly accessible. Only our server can reach it, using credentials that are never sent to the browser.
• Viewing or managing submissions requires an administrator login.
• Forms validate every field on the server, limit request sizes and repeated submissions, and filter automated spam.
• We don't log the content of form submissions.

How we handle personal data, and for how long, is set out in our Privacy Policy and Data Retention Policy.

CopperPin deployments run inside client environments, on client infrastructure. We do not require custody of production data beyond what the engagement scope explicitly requires. Client code and model artifacts remain client-owned from day one.

Access to client systems is agreed with each client and governed by the engagement agreement. Detailed security documentation is provided during engagement qualification.

If you believe you have found a security vulnerability in copperpin.io, please email security@copperpin.io with enough detail for us to reproduce it. Please don't access other people's data or disrupt the service while testing. We don't run a paid bug bounty.