Legal entity: ModernDaySamurai LLC, doing business as Cadensia Studio
Registered address: 16192 Coastal Highway, Lewes, Delaware 19958
Contact: [email protected]
Effective date: the date shown at the top of this page.
We take the security of your data seriously. This statement summarises the technical
and organisational measures we use to protect Cadensia Studio. It supplements our
Privacy Policy and Annex II of our
Data Processing Agreement.
1. Hosting and network
The Service runs on reputable cloud infrastructure, with edge protection (CDN and a
web application firewall) in front of the application. Administrative access is
restricted to an allow-listed private network, and administrative routes are not
publicly reachable.
2. Encryption
Data is encrypted in transit using TLS. Sensitive fields are encrypted at rest,
including connected-platform session credentials, which are stored encrypted. We do
not store full payment-card numbers, which are handled by our payment provider.
3. Access control
We follow least-privilege, role-based access. Access to production systems and data
is limited to personnel who need it, is authenticated, and is logged. Personnel are
bound by confidentiality obligations.
4. Authentication
Accounts use passwordless, single-use, time-limited sign-in links by default
(optional password sign-in is also supported, stored only as a salted hash).
Sessions use signed, HTTP-only, SameSite cookies. Sign-in and other sensitive
endpoints are rate-limited.
5. Application security
We maintain secure development and change-management practices, review code before
it is merged, manage third-party dependencies and vulnerabilities, and keep
frameworks patched. We monitor errors and application health.
6. Data resilience
We take regular backups of application data and test restore procedures. We monitor
storage capacity and protect against exhausting it.
7. Incident response
We maintain an incident-response process. If we become aware of a personal-data
breach, we act to contain and remediate it and notify affected customers and the
relevant authorities where required, as described in our
Data Processing Agreement and applicable law.
8. Sub-processors
We use the sub-processors listed on our Sub-processors page, each
bound by data-protection obligations and selected with security in mind.
9. Your responsibilities
Security is shared. Keep your sign-in details and connected credentials secure, use
accounts and connections you are authorised to use, and tell us promptly if you
suspect a compromise.
10. Reporting a vulnerability
If you believe you have found a security issue, please contact [email protected]. We
ask that you act in good faith, avoid privacy violations and service disruption, and
give us a reasonable opportunity to fix the issue before disclosure.