Security at Autoping AI
We take the security of your data and your customers' data seriously. Here's how we protect it.
Last reviewed: March 1, 2026
Our Security Practices
Security is built into every layer of our product — not bolted on as an afterthought.
End-to-End Encryption
All data transmitted between your browser and our servers is encrypted using TLS 1.3. Data at rest is encrypted using AES-256, the same standard used by banks and government agencies.
Secure Infrastructure
Our platform runs on enterprise-grade cloud infrastructure with automated backups, geographic redundancy, and 99.9% uptime SLA. Access to production systems is strictly controlled.
Access Controls
Role-based access control (RBAC) ensures that employees can only access data necessary for their role. Administrative access requires multi-factor authentication and is logged.
Security Monitoring
We continuously monitor our systems for suspicious activity, unauthorized access attempts, and anomalies. Alerts are triaged by our security team 24/7.
Vulnerability Management
We conduct regular penetration testing and security audits. A responsible disclosure program allows security researchers to report vulnerabilities safely.
Incident Response
We have a documented incident response plan. In the event of a data breach, we will notify affected users within 72 hours as required by applicable regulations.
Technical Security Details
Data Encryption
- Transport Layer Security: TLS 1.3 for all connections.
- Database encryption: AES-256 at rest.
- Backup encryption: AES-256 with separate key management.
- API tokens and secrets stored using secure key management services (KMS).
- Facebook access tokens stored encrypted, never logged in plaintext.
Authentication & Authorization
- Passwords hashed using bcrypt with a work factor of 12+.
- Two-factor authentication (2FA) available for all accounts.
- Session tokens are rotated on each login.
- Automatic session expiry after 30 days of inactivity.
- RBAC ensures least-privilege access for all users and internal employees.
Infrastructure Security
- Hosted on AWS with VPC isolation and private subnets.
- Web Application Firewall (WAF) in front of all public endpoints.
- DDoS mitigation through CloudFront and AWS Shield.
- Automated daily database backups with 30-day retention.
- Infrastructure as Code (IaC) for reproducible, auditable deployments.
- All production changes require code review and automated testing.
Application Security
- OWASP Top 10 mitigations applied across the application.
- CSRF protection on all state-changing API endpoints.
- Content Security Policy (CSP) headers to prevent XSS attacks.
- SQL injection prevention via parameterized queries and ORM.
- Rate limiting on all API endpoints to prevent abuse.
- Dependency scanning automated via CI/CD pipelines.
Compliance & Auditing
- Comprehensive audit logs for all administrative actions.
- Regular internal security reviews and external penetration tests.
- Adherence to Meta's Platform Policies and Data Use Policies.
- Data processing aligned with international best practices.
- Incident response plan with defined SLAs for breach notification.
Responsible Disclosure
We welcome reports from security researchers who find vulnerabilities in our platform. If you discover a security issue, please contact us privately before public disclosure. We commit to:
- Acknowledge your report within 48 hours.
- Provide regular updates on our remediation progress.
- Credit researchers who responsibly disclose issues (if desired).
- Not pursue legal action against good-faith security researchers.
Please report security vulnerabilities to: autopingai@ashmatech.com with the subject line "Security Vulnerability Report".
Security Questions?
Our security team is happy to answer questions from enterprise customers or security researchers. Get in touch.
Contact Security Team