INFORMATION SECURITY POLICY

1. SCOPE

This policy covers the ReggaeVerse OS platform, its database, file storage, background services and the internal tools our team uses to operate them. It applies to everyone with access to those systems, including contractors.

2. ACCESS CONTROL

• Access to production systems is limited to named individuals on a least-privilege basis.
• Administrative capabilities are role-based and recorded in a separate roles table, never on user profiles.
• Every data table enforces row-level security so a member can only reach their own records and records explicitly shared with them.
• Privileged service credentials are never exposed to the browser and are rotated when a team member leaves.

3. ENCRYPTION

All traffic is served over HTTPS with modern TLS. Data at rest, including uploaded audio, artwork and documents, is encrypted by our hosting provider. Passwords are stored only as salted hashes by our authentication provider, and new or changed passwords are checked against known breach corpora.

4. HOSTING AND NETWORK

The platform runs on managed cloud infrastructure behind a global edge network providing DDoS mitigation, bot filtering and rate limiting. We set security response headers including a content security policy, clickjacking protection, strict referrer policy and content-type protection.

5. SECURE DEVELOPMENT

• Changes are reviewed before release and database changes ship as versioned migrations.
• Automated security and dependency scans run against the codebase, and findings are triaged by severity.
• User-supplied links and content are sanitised before rendering to prevent script injection.
• Payment card data never touches our systems — it is handled entirely by our Merchant of Record.

6. LOGGING AND MONITORING

Application and database errors, authentication events and administrative actions are logged and monitored. Logs are retained only as long as needed for security and troubleshooting, and access to them is restricted.

7. BACKUPS AND CONTINUITY

The production database is backed up by our hosting provider with point-in-time recovery. Restores are performed to a separate environment so that recovery does not overwrite live data unintentionally.

8. PEOPLE

Everyone with access to personal data is bound by confidentiality obligations and receives guidance on phishing, credential hygiene and handling member data. Access is granted on joining a task and removed when it ends.

9. VENDORS

Providers are assessed before use — see the Vendor & Third-Party Risk Policy and the Subprocessor List.

10. REPORTING A VULNERABILITY

If you believe you have found a security issue, email abuse@reggaeverseos.com with enough detail to reproduce it. Please do not access other people's data or degrade the service while testing. We acknowledge reports and will keep you updated. Confirmed incidents follow our Incident Response Policy.