Security is foundational to everything we build. Learn about our comprehensive approach to protecting your application configurations, data, and infrastructure.
We've built App Config.json from the ground up with security as our core principle. Every layer of our platform is designed to protect your data.
All configuration data is encrypted in transit using TLS 1.3 and at rest using AES-256-GCM. Your secrets are never exposed.
Every request is authenticated and authorized. No implicit trust between services. Micro-segmentation across all infrastructure.
Built to meet SOC 2 Type II, GDPR, HIPAA, and ISO 27001 requirements. Regular third-party audits ensure we stay compliant.
HSM-backed key management with automated rotation. Customer-managed keys (CMK) available on Enterprise plans.
24/7 security monitoring with automated anomaly detection. Immediate incident response by our dedicated security team.
Enterprise-grade DDoS mitigation with always-on protection. Our infrastructure absorbs and mitigates attacks automatically.
Your configuration data is protected with military-grade encryption at every stage — in transit, at rest, and in use.
App Config.json employs multiple layers of encryption to ensure your configuration data remains confidential and tamper-proof. Here's our approach:
We maintain rigorous compliance standards and undergo regular third-party audits to ensure your data is handled according to the highest security standards.
Independent audit of our security, availability, and confidentiality controls.
Full compliance with EU data protection regulations. Data Processing Agreement available.
BAA available for healthcare organizations. PHI data handled with extra safeguards.
International standard for information security management systems.
Transparency about data handling is essential. Here's exactly what we do with your configuration data.
Your configuration data is stored in geographically redundant data centers with automatic failover.
When you delete data, we permanently erase it from all systems including backups.
We collect minimal, anonymized usage data to improve our service and detect anomalies.
We never sell your data. Limited sharing only with essential service providers under strict agreements.
Granular access controls ensure only authorized personnel can view or modify your configurations.
Define custom roles with precise permissions. Pre-built roles for Admin, Editor, Viewer, and Auditor.
Enterprise SSO via SAML 2.0 and OIDC. Supports Okta, Azure AD, Google Workspace, and more.
Required for all accounts. Supports TOTP, WebAuthn/FIDO2, and hardware security keys.
Complete audit trail of all configuration changes, API calls, and user actions with immutable logs.
Restrict access to your account by IP address or CIDR range. Webhook IP allowlisting also available.
We maintain a structured incident response process aligned with industry best practices. Here's what happens when a security incident is detected.
Automated monitoring systems detect anomalies. Alerts are sent to our 24/7 Security Operations Center (SOC) and on-call security engineers.
Security team triages the alert, determines severity level, and activates the appropriate incident response team. Preliminary containment measures are applied.
Immediate containment actions are taken to limit impact. Affected systems are isolated. Customer impact is assessed and documented.
For customer-impacting incidents, affected customers are notified via status page, email, and direct contact for Enterprise accounts.
Deep investigation into root cause. Permanent fixes are developed, tested, and deployed. Systems are restored to full operation.
Full post-mortem conducted. Lessons learned documented. Security controls updated to prevent recurrence. Report shared with affected customers.
Reach out to the appropriate team for your security-related needs.
Found a security issue? We appreciate responsible disclosure and offer a bug bounty program.
security@appconfig.jsonNeed a DPA, BAA, security questionnaire, or compliance documentation?
legal@appconfig.jsonGeneral security questions, architecture reviews, or pre-sales security discussions.
security-info@appconfig.json