1. Security model
Gignal applies proportionate technical and organisational safeguards for a small SaaS product. No internet service can promise absolute security; this page states the controls we actually operate and the responsibilities we share with you.
2. Controls we use
- TLS for production traffic, secure cookies, HSTS, CSRF protection, and protective response headers.
- One-way password hashing, login throttling, optional two-factor authentication, and recovery codes.
- Role-based access and organisation-level data isolation in application queries.
- Restricted administrative access, automated backups with rotation, monitoring, and operational health checks.
- Short-lived import previews: uploaded CSV text is removed after confirmation, cancellation, or the import timeout.
3. Payments and integrations
Paddle acts as Merchant of Record for paid subscriptions and handles full card details; Gignal receives subscription identifiers and status, not the full card number. Google, Telegram, calendar, API, and webhook connections are optional and operate only after you configure or authorise them. Gignal never needs your online-banking, Upwork, or Payoneer password.
4. What you should do
- Use a unique password, enable 2FA, and protect recovery codes.
- Keep devices and browsers updated and sign out of shared devices.
- Grant team roles only to authorised people and review access after staffing changes.
- Verify exports, payment instructions, tax calculations, and imported data before relying on them.
- Do not upload secrets or special-category personal data unless it is necessary, lawful, and appropriately protected.
5. Report a vulnerability
Send a clear description, affected URL, reproduction steps, and potential impact to [email protected]. Do not access other people’s data, disrupt the service, extort, or publicly disclose a vulnerability before we have had a reasonable opportunity to investigate. We will acknowledge a credible report and coordinate remediation in good faith.
6. Scope of assurance
This page is not a certification, penetration-test report, uptime guarantee, or representation that every attack can be prevented. Unless explicitly announced with verifiable evidence, Gignal does not claim ISO 27001, SOC 2, PCI DSS certification, or independent audit coverage.