Security is core to how DevFuze Tools builds and operates systems—for our own products (including CalmaFinance and Tu Restaurante Digital) and for client work. This policy summarizes how we protect devfuzetools.com and the principles we apply to engineering engagements.
Our commitment
We design for least privilege, defense in depth, and secure defaults. Security is integrated into delivery—not bolted on after launch.
Website & infrastructure
- HTTPS everywhere on devfuzetools.com with TLS provided by our hosting platform.
- Production hosting on Vercel with managed patching and DDoS mitigation at the edge.
- Environment secrets (API keys, email credentials) stored only in secure environment variables—never in source code or client bundles.
- Dependencies monitored and updated; security patches applied on a reasonable schedule.
Application security
- Input validation and HTML escaping on server-side handlers (e.g., contact API).
- No storage of sensitive payment data on the marketing site; client applications follow their own PCI or domain-specific requirements.
- Principle of least privilege for repository, cloud, and CI/CD access.
- Code review and automated checks where appropriate before production deploys.
Access control
Internal access to production systems, cloud consoles, and client environments is limited to personnel who need it for their role. We encourage multi-factor authentication on critical accounts and rotate credentials when team membership changes.
Client & project data
For client engagements, data handling follows agreed contracts and scope. We do not use client production data for unrelated purposes. When we access client systems, we do so through approved channels (VPN, SSO, or client-provided tooling) and document access where required.
Secrets & credentials
- Secrets managed via environment variables, vaults, or cloud secret managers—not committed to Git.
- API keys scoped to minimum required permissions.
- Separate credentials per environment (development, staging, production) where feasible.
Monitoring & incident response
We monitor availability and errors on systems we operate. If we detect a security incident affecting our website or a client environment under our management, we investigate promptly, contain impact, notify affected parties as required, and document remediation steps.
Vendors & subprocessors
We evaluate vendors (hosting, email, analytics, cloud providers) for security posture and use them according to their documented security programs. A list of key subprocessors for the marketing site includes Vercel and Resend.
Compliance & standards
We align engineering practices with widely adopted frameworks (e.g., CIS benchmarks, OWASP guidance, and cloud provider best practices). For regulated clients, we support SOC 2, ISO 27001, HIPAA, or other requirements as scoped in the engagement.
Reporting a vulnerability
If you believe you have found a security issue on devfuzetools.com or a DevFuze-operated service, please report it responsibly to contact@devfuzetools.com with enough detail to reproduce the issue. Do not publicly disclose before we have had a reasonable time to investigate. We appreciate coordinated disclosure.
Policy updates
We may revise this Security Policy as our practices evolve. The “Last updated” date indicates the current version.