TerminalStreet Security

At TerminalStreet, we understand we're building critical infrastructure for our customers. We go to great lengths to protect the security of your account, your data, and your applications.

Compliance

We conduct regular internal security audits and work with external auditors to review our hardware, software, and physical security configurations. Our vulnerability disclosure program rewards users and security researchers who find issues with our software and web services. If we discover a vulnerability, we follow a formal incident response framework to ensure rapid mitigation and transparent customer communication.

Product Security

Account Security

We serve our website exclusively via HTTPS, and all our APIs are served over HTTPS and TLS 1.2+ by default. We offer robust two-factor authentication (2FA) capabilities for account logins to help you protect your account. Our 2FA implementation includes:

• Time-based One-Time Password (TOTP) authentication
• WebAuthn/FIDO2 security key support
• Backup recovery codes with secure verification
• Rate limiting to prevent brute force attacks
• Constant-time comparison for code verification to prevent timing attacks

We allow you to create multiple customizable access tokens for granular control over access to your account resources.

Software Security

We have a continuous software update process to keep our systems up-to-date with the latest stable versions of compute images and application runtimes. We monitor documented threats from public security research databases, and we run automated vulnerability scanners at regular intervals across our infrastructure and before each deployment.

Our developers receive training for secure software development, including OWASP (Open Web Application Security Project) guidelines. All major code changes are subject to a multi-point code review with specific attention paid to security.

DoS Protection and Rate Limiting

To prevent denial of service attacks, we've implemented comprehensive memory protection mechanisms for our rate limiting system:

• Size limits for rate limiting stores (IP: 10K, Account: 5K, TOTP: 3K, Backup: 1K entries)
• Tiered cleanup strategy with regular (15 min), aggressive (80% capacity), and emergency (100% capacity) cleanups
• Security monitoring with alerts for potential attacks
• Statistics tracking for memory usage patterns

Data Privacy

Your projects and data can be fully secured with private repositories and access controls. New projects are private by default and existing projects can be configured with granular permissions. API tokens provide a powerful way to control access: users can create, revoke, and monitor the usage of resources based on tokens.

Infrastructure Security and Resilience

Physical Security

Our infrastructure runs inside data centers designed and operated by professional cloud service providers. These data centers feature state-of-the-art environmental security controls to safeguard against fires, power loss, and adverse weather conditions. Physical access to these facilities is highly restricted and they are monitored by professional security personnel.

DDoS Mitigation

We maintain firewalls on our edge servers and origin load balancers to protect against bandwidth and protocol-based attacks, and we use intelligent web application firewalls and elastic scaling of our compute capacity to mitigate attacks at the application layer, including complex and evolving attacks.

Data Security

All customer data is stored with at least dual redundancy, and we've designed our storage solution for high durability. All TerminalStreet accounts come with built-in encryption at rest, ensuring your data remains secure even when stored.

Backup Code Verification

Our backup code verification system incorporates multiple security enhancements:

• Constant-time comparison to prevent timing attacks using crypto.timingSafeEqual
• Minimum verification time of 500ms to prevent timing analysis
• Integration with rate limiting system for brute force protection
• Dedicated security event types for backup code operations
• Consecutive failure tracking with breach detection thresholds
• Early code format validation before expensive operations

Logging

We log activity across our platform, from individual API requests to infrastructure configuration changes. Logs are aggregated for monitoring, analysis, and anomaly detection and archived in vaulted storage. We implement measures to detect and prevent log tampering or interruptions.

Security Response

Our engineering teams, in addition to the Security team, maintain a responsive on-call rotation to address any threats or vulnerabilities that are identified. We follow a formal incident response process that includes containment, eradication, recovery, and lessons learned phases.

Risk Management

Vendor Management

We have a defined vendor management program that assesses vendors and sub-processors prior to engagement to ensure that our stringent security requirements are being met.

Payment Processing

We process payments with secure payment processors that are certified to PCI Service Provider Level 1, the most stringent level of PCI DSS certification available. Payment information is transmitted directly to our payment processor via HTTPS for secure storage and is never transmitted to or stored on TerminalStreet servers.

Security Best Practices

We recommend the following best practices to help ensure the security of your TerminalStreet account and applications:

• Enable two-factor authentication on your account
• Regularly rotate your API keys and access tokens
• Use the principle of least privilege when creating access tokens
• Keep your contact information up to date to receive security notifications
• Monitor your account activity for unauthorized access
• Use strong, unique passwords for your TerminalStreet account

Security Certifications and Compliance

TerminalStreet maintains compliance with industry security standards and best practices. Our security program is built on internationally recognized frameworks, including:

• Controls aligned with the SOC 2 Trust Services Criteria for Security, Availability, and Confidentiality (not independently certified)
• Practices aligned with ISO/IEC 27001 (not certified)
• NIST Cybersecurity Framework
• OWASP Top 10 vulnerabilities mitigation
• GDPR and CCPA compliance for data protection

We continuously review and update our security program to address evolving threats and regulatory requirements.

Vulnerability Management Program

Our vulnerability management program includes:

• Automated security scanning of our infrastructure and applications
• Regular penetration testing conducted by qualified third parties
• Continuous monitoring for new vulnerabilities in our dependencies
• Risk-based prioritization of vulnerability remediation
• Defined patching timelines based on vulnerability severity

Critical vulnerabilities are addressed within 24 hours, with high, medium, and low severity issues remediated on appropriate timelines according to our security policies.

Security Development Lifecycle

Security is built into our development process from the beginning. Our Security Development Lifecycle includes:

• Security requirements definition at project initiation
• Threat modeling during design phase
• Secure coding guidelines and training for developers
• Static and dynamic application security testing
• Security code reviews
• Pre-production security validation
• Post-deployment security monitoring

Data Breach Notification Procedures

In the event of a data breach affecting personal or sensitive information, TerminalStreet follows a comprehensive incident response plan that includes:

• Immediate containment and investigation of the breach
• Assessment of the nature and scope of the incident
• Documentation of affected data and impacted individuals
• Notification to affected users without undue delay, typically within 72 hours of discovery
• Coordination with law enforcement authorities when appropriate
• Implementation of measures to prevent similar incidents
• Compliance with applicable breach notification laws in relevant jurisdictions

Our incident response team conducts regular drills and tabletop exercises to ensure readiness for potential security incidents.

Access Controls

We implement strict access controls following the principle of least privilege:

• Role-based access control (RBAC) for all systems and data
• Multi-factor authentication required for all staff accessing production systems
• Regular access review and privilege management
• Automated provisioning and de-provisioning of access
• Secure credential management with regular rotation
• Session timeouts and automatic locking of inactive sessions

Infrastructure Security and Resilience

Physical Security

Our infrastructure runs inside data centers designed and operated by professional cloud service providers. These data centers feature state-of-the-art environmental security controls to safeguard against fires, power loss, and adverse weather conditions. Physical access to these facilities is highly restricted and they are monitored by professional security personnel.

DDoS Mitigation

We maintain firewalls on our edge servers and origin load balancers to protect against bandwidth and protocol-based attacks, and we use intelligent web application firewalls and elastic scaling of our compute capacity to mitigate attacks at the application layer, including complex and evolving attacks.

Data Security

All customer data is stored with at least dual redundancy, and we've designed our storage solution for high durability. All TerminalStreet accounts come with built-in encryption at rest, ensuring your data remains secure even when stored.

Backup Code Verification

Our backup code verification system incorporates multiple security enhancements:

• Constant-time comparison to prevent timing attacks using crypto.timingSafeEqual
• Minimum verification time of 500ms to prevent timing analysis
• Integration with rate limiting system for brute force protection
• Dedicated security event types for backup code operations
• Consecutive failure tracking with breach detection thresholds
• Early code format validation before expensive operations

Logging

We log activity across our platform, from individual API requests to infrastructure configuration changes. Logs are aggregated for monitoring, analysis, and anomaly detection and archived in vaulted storage. We implement measures to detect and prevent log tampering or interruptions.

Security Response

Our engineering teams, in addition to the Security team, maintain a responsive on-call rotation to address any threats or vulnerabilities that are identified. We follow a formal incident response process that includes containment, eradication, recovery, and lessons learned phases.

Contact Us

If you have any security concerns or questions about our security measures, please contact our security team at: [email protected]

For information on reporting security vulnerabilities, please visit our vulnerability disclosure page.