Our practices

• Encryption in transit. All API and web traffic is served over HTTPS/TLS.
• Authentication. APIs require per-key credentials; the console uses single sign-on with the Airfree identity service. Keys are scoped and can be rotated.
• Least privilege. Each service connects to its own database with a least-privilege role, limiting the blast radius of any single compromise.
• Isolation. Workloads run behind a single hardened edge; administrative consoles are restricted to our private network and VPN.
• Error handling. Errors return a generic message with a reference code; full detail is kept in our internal error-tracking, never leaked to clients.

Certifications

We do not currently hold formal third-party certifications such as SOC 2 or ISO 27001. We will say so plainly here if and when that changes — we will not imply a certification we do not hold. If your procurement needs specific attestations, talk to us about what we can provide.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email security@airfree.au with enough detail to reproduce it. Please:

• Give us a reasonable chance to investigate and fix the issue before any public disclosure.
• Avoid privacy violations, data destruction, and service disruption while testing.
• Do not access or modify data that is not yours.

We do not currently run a paid bug-bounty programme, but we are grateful for good-faith reports and will acknowledge them. Do not include secrets or customer data in your report.