Information Security

Argon Development · Version 1.0 · 2026-07-14

---

1. Purpose

This page summarises the technical and organisational security measures Argon Development applies to protect user data and system integrity in accordance with AVG/GDPR article 32.

---

2. Scope

These measures apply to:

• Marketing website and web portal (Vercel / Cloudflare)
• API and backend services (FastAPI)
• Database (PostgreSQL)
• Native terminal (authentication token handoff)
• Third-party processors: Stripe, Resend, Cloudflare

---

3. Technical and organisational measures

Domain	Measure
Transport	TLS on all endpoints; HSTS in production
Authentication	Argon2id password hashing; HttpOnly JWT session cookies; refresh token rotation
Secrets management	Environment variables only; no secrets in source code or client-side bundles
API security	Rate limiting; CORS allowlist; internal endpoints secured with server-side validation
Database	Least-privilege database user; no public database port exposed
Logging	No passwords or tokens written to logs
Backups	Daily encrypted database backups; tested restore procedure
Patch management	Dependency updates reviewed weekly; critical security patches applied within 30 days
Access control	Production access limited to authorised personnel; MFA required on GitHub, Vercel, and Stripe

---

4. Incident response (data breach)

1. Detection → classify severity within 24 hours
2. Notify the Autoriteit Persoonsgegevens and affected users within 72 hours where required (AVG art. 33/34)
3. Document: timeline, impact, remediation steps
4. Post-mortem review within 14 days

Incident contact: contact@argon-development.com

---

5. Sub-processor security

Argon performs due diligence on Stripe, Resend, Vercel, and Cloudflare. Data processing agreements are in place where required under AVG.

---

6. Review

Security measures are reviewed annually or following any material change to system architecture.

---

7. Contact

Security questions or responsible disclosure: contact@argon-development.com