Security Policy

1. Our Commitment to Security

At AM Now Developers, security is not an afterthought — it is a foundational design principle embedded in every layer of our infrastructure, services, and operations. We provide managed hosting, web development, AI and analytics solutions, and government IT services to clients who depend on us to protect sensitive data, maintain service availability, and operate with integrity.

We are committed to implementing and continuously improving security controls appropriate to the nature and scale of the data we handle, including data subject to government contract requirements and applicable Texas state law. This Security Policy describes the technical and organizational measures we employ to protect our systems, your data, and the trust you place in us.

2. Infrastructure Security

Our hosting infrastructure is built and maintained with multiple layers of security controls:

TLS / HTTPS Encryption in Transit

All traffic to and from our websites and client-facing applications is encrypted using Transport Layer Security (TLS) 1.2 or 1.3. We enforce HTTPS on all endpoints with HTTP Strict Transport Security (HSTS) headers to prevent protocol downgrade attacks. SSL/TLS certificates are maintained, renewed automatically, and monitored for expiration.

Server Hardening

Our servers are configured following industry hardening guidelines. Unnecessary services, ports, and software packages are disabled or removed. Operating systems and server software are patched on a regular cadence, with critical security patches applied as soon as possible following disclosure. We use firewall rules to restrict inbound and outbound traffic to only the ports and protocols required for each service.

Network Security

We deploy network-level protections including:

• Intrusion detection and prevention systems (IDS/IPS) to monitor for suspicious traffic patterns
• DDoS mitigation at the network edge to absorb volumetric attacks before they impact hosted services
• Network segmentation to isolate production, staging, and administrative environments from one another
• IP allowlisting for administrative access to server management interfaces and control panels
• Rate limiting and bot protection on login endpoints and public-facing APIs

Physical Security

Our infrastructure is hosted in data centers that maintain physical security controls including 24/7 on-site security personnel, badge access controls, surveillance cameras, and environmental protections against fire, flood, and power failure. We select hosting partners that hold recognized security certifications such as SOC 2 Type II, ISO 27001, or equivalent.

3. Access Controls

We apply the principle of least privilege across all of our systems: every user, service account, and process is granted only the minimum permissions required to perform its specific function.

Authentication

Our client portal and administrative interfaces use JSON Web Token (JWT) based authentication. JWTs are signed with a strong secret key, set to expire after a short, configurable period, and are validated on every authenticated request. We do not store JWTs in insecure locations; tokens transmitted to client browsers are handled in a manner designed to mitigate cross-site scripting (XSS) and cross-site request forgery (CSRF) risks.

Password Security

All user passwords stored in our systems are hashed using bcrypt, an adaptive password-hashing algorithm designed to remain computationally expensive as hardware improves. Plaintext passwords are never stored, logged, or transmitted. Password requirements enforce a minimum length of twelve characters and a combination of character types.

Multi-Factor Authentication (MFA)

Multi-factor authentication is available for client portal accounts and is required for all internal administrative accounts. MFA is supported via time-based one-time passwords (TOTP) compatible with standard authenticator applications. We encourage all clients to enable MFA on their accounts to significantly reduce the risk of unauthorized access even if credentials are compromised.

Role-Based Access Control

Our systems implement role-based access control (RBAC) to ensure that users can only access the data and functionality relevant to their role. Client accounts are isolated from one another — one client cannot access another client's data, invoices, or project materials.

4. Data Encryption

Encryption in Transit

All data transmitted between your browser and our services travels over HTTPS with TLS 1.2 or 1.3 encryption. This applies to the main website, the client portal, API endpoints, administrative interfaces, and payment flows. We disable older, insecure protocols (SSL 3.0, TLS 1.0, TLS 1.1) on all endpoints and use strong cipher suites that support forward secrecy.

Encryption at Rest

Sensitive data stored in our databases and file systems is encrypted at rest using AES-256 encryption or equivalent industry-standard algorithms. Database fields containing particularly sensitive information — such as API keys, payment tokens, and personal identifiers — are encrypted at the application layer in addition to storage-level encryption, providing defense in depth.

Key Management

Encryption keys are managed separately from the data they protect. We rotate keys on a scheduled basis and after any security event. Access to encryption keys is restricted to automated systems and the minimum number of authorized personnel necessary.

5. Account Security

Brute Force Protection

Login endpoints are protected against brute force and credential stuffing attacks. After a configurable number of consecutive failed login attempts, accounts are temporarily locked and the account holder is notified by email. IP addresses that exhibit repeated failed login patterns across multiple accounts may be temporarily blocked at the network level.

Password Requirements

All accounts must meet the following password requirements:

• Minimum twelve (12) characters in length
• Must include at least one uppercase letter, one lowercase letter, one number, and one special character
• Must not be a commonly used or previously breached password (checked against known breach datasets)
• Must not match any of the account holder's previous five passwords

Session Management

Authenticated sessions expire after a period of inactivity. Sessions are invalidated server-side upon logout — it is not sufficient to simply delete a local token. Concurrent session limits and suspicious session activity (such as logins from geographically distant locations within a short time window) trigger alerts and optional step-up authentication.

Account Activity Notifications

We send automated email notifications when significant account events occur, including: successful login from a new device or location, password changes, email address changes, MFA enrollment or removal, and invoice generation or payment failure.

6. Client Portal Security

The AM Now Developers client portal is designed to provide secure, isolated access to each client's project data, invoices, support tickets, and hosted service information.

Session Management

Client portal sessions are managed server-side using signed, short-lived JWT access tokens paired with longer-lived refresh tokens stored securely. Sessions are tied to the user agent and IP address at login. Anomalous session activity — such as a token being used from a significantly different IP address mid-session — triggers re-authentication.

Data Isolation

Each client's data is logically isolated within our database architecture. Access control checks are enforced at the application layer on every query to ensure that authenticated client users can only retrieve and modify data belonging to their own account. We perform regular audits of data access patterns to verify isolation controls are functioning correctly.

Audit Logging

All significant actions taken within the client portal — including logins, document downloads, invoice payments, support ticket submissions, and configuration changes — are recorded in immutable audit logs. These logs are retained for a minimum of twelve months and are available to clients upon request for their own account activity.

7. Stripe and PCI Compliance

AM Now Developers does not directly collect, process, transmit, or store credit card numbers or other cardholder data. All payment processing is handled exclusively by Stripe, Inc., a PCI DSS Level 1 certified payment processor — the highest certification level in the PCI standards framework.

When you enter payment information on our Site or in the client portal, your card data is transmitted directly from your browser to Stripe's secure servers using Stripe's JavaScript library (Stripe.js). Your card number, CVV, and expiration date never pass through our servers or touch our infrastructure. We receive only a non-sensitive payment method token from Stripe, which we use to initiate charges and manage subscriptions.

Because payment data flows directly to Stripe, AM Now Developers operates under a significantly reduced PCI scope. Our internal systems are assessed periodically for PCI compliance posture in relation to our role as a merchant that delegates cardholder data handling to a compliant processor.

For more information on Stripe's security practices, visit stripe.com/docs/security.

8. Backup and Disaster Recovery

We maintain comprehensive backup and disaster recovery capabilities to protect against data loss and ensure business continuity for our managed hosting clients and internal operations.

Backup Schedules

Client website files and databases on our managed hosting plans are backed up on a daily basis, with backups retained for a minimum of thirty (30) days. Managed hosting plans at higher service tiers include more frequent backups and longer retention windows as specified in the applicable service agreement. Backups are stored in geographically separate locations from the primary data to protect against regional failures.

Backup Encryption and Integrity

All backups are encrypted at rest using AES-256. Backup integrity is verified on a scheduled basis through automated restoration tests. We maintain backup verification logs and investigate any backup failures immediately.

Recovery Time and Point Objectives

Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) vary by service tier and are defined in client service agreements. Our standard managed hosting service targets an RPO of 24 hours (meaning no more than 24 hours of data loss in a worst-case scenario) and an RTO sufficient to restore services within one business day for non-emergency recovery events.

Disaster Recovery Planning

We maintain and periodically test a disaster recovery plan that documents procedures for responding to significant outages, data center failures, and other business continuity events. The plan is reviewed and updated at least annually or following any significant infrastructure change.

9. Incident Response

We maintain a documented incident response plan for identifying, containing, and recovering from security incidents. The key phases of our incident response process are:

• Detection and Identification: Security events are detected through automated monitoring, intrusion detection systems, and manual review. We monitor system logs, authentication events, and network traffic for indicators of compromise on an ongoing basis.
• Containment: Upon confirming a security incident, our team takes immediate steps to contain the threat — isolating affected systems, revoking compromised credentials, and blocking malicious traffic to prevent further damage.
• Eradication and Recovery: We identify and remove the root cause of the incident, restore affected systems from clean backups or known-good states, and verify that systems are secure before returning them to production.
• Client Notification: If a security incident affects client data or services, we will notify affected clients promptly in accordance with applicable law and contract obligations. Notification will include a description of the incident, the data or services affected, the steps we have taken to address it, and recommended actions for clients.
• Post-Incident Review: After each significant incident, we conduct a post-mortem analysis to identify root causes, assess the effectiveness of our response, and implement preventive measures to reduce the likelihood of recurrence.

10. Employee Access Controls

Access to client data and production systems is restricted to authorized AM Now Developers personnel who require that access to perform their job responsibilities. We implement the following controls governing employee access:

• Background checks: Employees and contractors with access to client data or production infrastructure undergo background screening prior to being granted access.
• Access provisioning and deprovisioning: Access is provisioned at onboarding based on documented role requirements and revoked promptly upon separation or role change. We conduct periodic access reviews to identify and remove stale or excessive permissions.
• MFA required: All internal administrative accounts require multi-factor authentication. No exceptions are made for production system access.
• VPN and SSH key controls: Remote access to production infrastructure requires VPN authentication and key-based SSH access. Password-based SSH authentication is disabled.
• Acceptable use policy: Employees are bound by an Acceptable Use Policy and a confidentiality agreement governing their handling of client data and company systems.
• Security training: All employees complete security awareness training at onboarding and annually thereafter, covering topics including phishing recognition, password hygiene, incident reporting, and data handling procedures.

11. Third-Party Security Assessments

We recognize that independent, objective assessment of our security posture is an important component of a mature security program. We engage third-party security professionals to evaluate our systems and controls on a periodic basis.

Our third-party assessment program includes:

• Penetration testing: We commission external penetration tests of our web applications, APIs, and network infrastructure to identify vulnerabilities that internal reviews may miss. Findings are remediated on a risk-prioritized basis.
• Vendor security review: Third-party services and software integrated into our infrastructure are evaluated for security posture before adoption. We review the security documentation, certifications, and privacy practices of key vendors including hosting providers, payment processors, and analytics platforms.
• Dependency scanning: Our development pipelines include automated scanning of open-source dependencies for known vulnerabilities (CVEs). Critical vulnerabilities in dependencies trigger immediate remediation action.

Results of third-party security assessments are confidential but may be summarized or attested to upon request for clients with contractual requirements such as government contracts or enterprise procurement processes. Please contact security@amnowdevelopers.com to discuss your specific requirements.

12. Responsible Disclosure

AM Now Developers welcomes responsible disclosure of security vulnerabilities discovered in our systems, websites, or applications. If you believe you have found a security vulnerability, we ask that you follow the guidelines below:

Reporting a Vulnerability

Please send vulnerability reports to security@amnowdevelopers.com. Include as much detail as possible to help us reproduce and assess the issue, including:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce the issue (proof of concept)
• The URL, endpoint, or system component affected
• Any tools or techniques used in discovery
• Your contact information if you are willing to follow up with our team

Our Commitments

In return for responsible disclosure, we commit to:

• Acknowledging receipt of your report within 72 hours
• Providing regular updates on the status of remediation
• Not pursuing legal action against researchers who act in good faith within these guidelines
• Crediting researchers who responsibly disclose vulnerabilities (upon their request) once the vulnerability is resolved

Scope and Guidelines

Please do not: access, modify, or delete client data; perform denial-of-service attacks; conduct social engineering against our staff or clients; or disclose vulnerabilities publicly before we have had a reasonable opportunity to investigate and remediate. Testing should be limited to your own accounts or test environments we have explicitly authorized.

13. Contact Our Security Team

For security-related questions, vulnerability reports, or to request security documentation for procurement purposes, please contact us: