HERLINE – SECURITY POLICY

Herline is committed to protecting the privacy, safety, and trust of everyone who uses our platform.

This Security Policy explains how we safeguard data, prevent unauthorised access, and maintain the reliability of our systems.

Herline Ltd follows the UK Data Protection Act 2018 and GDPR standards.

We ensure that all personal data:

• is processed lawfully, fairly, and transparently;
• is collected for specific, legitimate purposes;
• is limited to the minimum data required;
• is kept accurate and up to date;
• is stored securely and retained only as long as necessary.

• Our servers use industry-standard encryption (TLS 1.2+).
• All databases are protected by multi-layer firewalls and real-time threat monitoring.
• Administrative access is strictly controlled using multi-factor authentication.
• Regular penetration tests and vulnerability scans are performed to detect potential risks.

• All financial transactions are handled by Stripe, a PCI DSS Level 1 certified payment processor.
• No credit-card or bank details are ever stored on Herline's servers.
• Stripe's secure APIs handle encryption, tokenisation, and fraud prevention.

• Data transmitted between the app, website, and servers is encrypted end-to-end.
• Herline uses secure JWT authentication to prevent session hijacking.
• Accounts are locked after repeated failed login attempts to protect users from brute-force attacks.

Security is a shared commitment. We ask all users to:

• Create strong, unique passwords;
• Keep login credentials private;
• Immediately report suspicious activity to [email protected].

If a breach occurs, Herline Ltd will:

1. Notify affected users promptly;
2. Inform the ICO (UK Information Commissioner's Office) when required;
3. Take immediate remedial action to secure the system;
4. Provide transparent updates on impact and resolution.

We partner only with vendors that maintain strong compliance standards (such as Google Firebase, Expo, and Stripe).

Each partner must follow strict contractual obligations to protect user data.

Our infrastructure and security measures are regularly reviewed.

We may update this Policy to reflect new regulations or technological advancements.

All updates will appear on our website with a new "Last updated" date.

Questions or concerns about this Security Policy?

Email us at [email protected].