Infrastructure
- TLS 1.3 encryption for all connections
- PostgreSQL with AES-256 encryption at rest
- Daily automated backups with point-in-time recovery
- Hosted on DigitalOcean with DDoS protection
Payments
- Stripe handles all card payments with PCI-DSS Level 1 compliance
- We never store credit card numbers on our servers
- P2P payments (Zelle, Venmo) are processed directly between parties
Access Control
- Two-factor authentication (TOTP) available for all accounts
- Role-based access control (owner, admin, crew)
- Session management with automatic expiration