Security & Disclosure

Studio

Silvanè Studios

Based in

Ontario, Canada

Contact

hello@silvanestudios.com

1. How accounts are protected

• Passwords are never stored. Only a bcrypt hash is kept, which cannot be reversed. A reset replaces the hash rather than recovering anything.
• Sessions are revocable. Each sign-in creates a session record, so a session can be ended from our side — signing out everywhere actually means everywhere.
• Sign-in and account forms are protected against cross-site request forgery, so another website cannot submit them as you.
• Sensitive actions are rate-limited, which blunts password guessing and automated abuse.
• Everything is served over HTTPS.

2. How one client is kept away from another

The workspace is multi-tenant, so this is the risk that matters most. Every query is filtered by the viewer’s own memberships in the database query itself, which means another client’s rows never leave the database — a bug in the interface cannot leak them, because they were never fetched. Permission checks read the organisation from the record being accessed, never from anything the browser sent, and no part of the system accepts a tenant identifier as input. Staff access to client records is a separate, deliberately narrow surface with an audit trail behind it.

3. What we do not claim

Silvanè Studios is a small independent studio. We are not going to pretend otherwise on a security page.

• We hold no SOC 2, ISO 27001, or equivalent certification.
• We have not commissioned a third-party penetration test.
• There is no 24/7 monitoring desk, and no paid bug bounty.
• We are not PCI certified, and we avoid needing to be: card details are entered on Stripe’s own checkout page and never reach our servers.
• No system is perfectly secure, including ours.

If your procurement process requires certifications we do not hold, we would rather tell you now than sell around it.

4. Client project security

Sites we build are deployed into your hosting account, so you hold the keys and the ultimate control. Every build ships over HTTPS, keeps secrets out of the repository, and applies the framework’s own protections. Where we hold credentials for a client system, they are kept in a password manager and access is removed when the engagement ends. If you would like us to remove access sooner, say so and it is done the same day.

5. Reporting a vulnerability

If you find a security problem in this site or in a site we built, please tell us before you tell anyone else. Email hello@silvanestudios.com with what you found, how to reproduce it, and how you would like to be credited.

What you can expect from us:

• An acknowledgement within 3 business days.
• An honest assessment of the severity and a target fix date.
• Credit on this page if you want it, once the fix is live.
• No legal action against you for good-faith research that follows the rules below.

6. Rules for research

Test only against your own account and your own data. Do not access, modify, or keep anyone else’s information; stop as soon as you have confirmed a problem exists. No denial of service, no spam, no social engineering of the studio or its clients, and no physical attempts. Give us reasonable time to fix something before publishing it.

We do not pay bounties. We will say thank you properly, publicly if you want, and we will fix what you find.

7. If something goes wrong

In the event of a breach affecting personal information, we will investigate immediately, contain it, and notify affected clients and the Office of the Privacy Commissioner of Canada where the law requires it. We will tell you what happened, what was affected, and what we changed — in plain language, and without waiting until we have a comfortable version of the story.

8. Related

The Privacy Policy covers what we hold and for how long. The Sub-processors page names every vendor that can touch it.