Security
Security is part of how we build, not something added afterwards. This page describes how we protect the systems and information entrusted to us, and how to report a security issue.
Last updated October 6, 2026
Infrastructure
Our services run on Google Cloud and our websites are delivered by Vercel. All traffic is served over encrypted connections (HTTPS). Our application programming interfaces sit behind a web application firewall that filters malicious requests and limits abusive traffic. Secrets such as passwords and keys are held in a managed secrets service, never in our code, and access to production systems follows the principle of least privilege.
Data protection
Data is encrypted in transit and is encrypted at rest by our cloud provider. Our production databases are backed up daily and support recovery to a point in time. Access to systems and data is limited by role, and significant actions in our products, such as changes to user roles and access to the data room, are recorded in audit trails.
Application security
- Input is validated, and requests are authenticated and authorised before they are processed.
- Every change passes automated checks before release, and changes to our backend services reach production only after a period of running in a separate staging environment.
- We track known vulnerabilities in the software we depend on and fix them according to their severity.
Operational security
We monitor and log system activity to detect and respond to problems, and we design our logging to avoid recording sensitive information unnecessarily. We respond promptly to security events and learn from them.
Reporting a vulnerability
If you believe you have found a security vulnerability in our website or services, please email security@slastech.com with enough detail for us to reproduce it. We aim to acknowledge reports within three business days and to keep you informed while we investigate and fix the issue.
When you test and report, please:
- avoid accessing, changing or deleting data that does not belong to you, and stop as soon as you have shown the issue;
- avoid any action that could degrade or interrupt our services, including denial-of-service testing;
- do not use social engineering, phishing or physical attacks against our staff or premises;
- give us a reasonable time to fix the issue before disclosing it publicly.
We will not take legal action against anyone who reports a vulnerability to us in good faith and follows these guidelines.
Privacy
Security and privacy go together. For how we handle personal information, see our Privacy Policy at slastech.com/privacy.
Contact
For security questions or reports, email security@slastech.com.