Security & Disclosure

1. How we secure your data

Dropify runs entirely on Cloudflare’s edge network. All traffic to and from the brain API, the dashboard, and the waiting-room service is encrypted in transit via TLS 1.2+. Data at rest — tenant records, adapter keys, and forensic audit events — is stored in Cloudflare D1 and protected by D1’s built-in encryption at rest.

Admission passes issued by the queue are cryptographically signed and single-use; they are verified locally by the edge adapter without a round-trip to our servers, so they cannot be forged or replayed. Secrets (base secrets, signing keys) are stored in Cloudflare Workers Secrets and are never written to logs, responses, or the dashboard UI.

We do not currently hold a SOC 2, ISO 27001, or other third-party security certification. If that changes, we will publish it here.

2. Cookie inventory

We set only strictly functional cookies — none are used for analytics or advertising, which is why no consent banner is shown. This is the full inventory referenced from our Privacy Policy:

Cookie	Purpose	Lifetime
dropify_locale	Remembers your chosen language (English or Dutch) across visits.	Persistent
better_auth_session	Dashboard login session. Set on the dashboard domain only; HttpOnly.	Session
ws_bind	Binds a browser to its queue state during a drop. Contains a random nonce only; HttpOnly.	24 hours
ws_queue_pass	Cryptographic admission pass issued after proof-of-work and bot challenge; verified locally by the edge adapter. HttpOnly.	15 minutes
ws_queue_hint	Small functional hint used by the waiting room to resume a visitor’s position without a server round-trip.	Session

3. Responsible disclosure

If you believe you’ve found a security vulnerability in Dropify — the brain API, dashboard, open-source adapters, or the waiting room — please report it to security@dropify.dev. Include as much detail as you can: affected endpoint or component, steps to reproduce, and potential impact.

• We will acknowledge your report within 72 hours.
• We will not pursue legal action against good-faith security research conducted under this policy.
• Please give us a reasonable opportunity to investigate and remediate before any public disclosure.
• Please avoid accessing, modifying, or deleting other tenants’ data, and avoid degrading service for other users while testing.

4. Contact

Security reports: security@dropify.dev
General privacy inquiries: privacy@dropify.dev