Security at Ingress

Security is foundational to everything we build. We are committed to protecting your software, your data, and your customers.

Encryption Everywhere

All data is encrypted in transit with TLS 1.3 and at rest with AES-256. API communications use HTTPS exclusively with strict certificate validation.

Code Signing

All software releases and updates are signed with Ed25519 cryptographic signatures. The Sparkle update framework verifies signatures before installation, preventing tampering.

Licence Security

Licence keys are hardware-bound and validated server-side. Activation attempts are rate-limited and monitored for abuse. Compromised keys can be revoked instantly.

Infrastructure Security

Our infrastructure runs on hardened, regularly-patched systems with network-level isolation, intrusion detection, and comprehensive logging. All access requires multi-factor authentication.

Privacy by Design

We collect only the minimum data necessary to provide our services. Payment data is processed exclusively by Stripe and never touches our servers. We do not sell or share personal information.

Incident Response

We maintain a documented incident response plan with defined escalation procedures. In the event of a security incident, affected users will be notified promptly with clear guidance.

Responsible Disclosure

We take security vulnerabilities seriously. If you discover a security issue in any of our products or infrastructure, we ask that you report it responsibly so we can address it promptly.

How to Report

Send your report to security@ingressvc.com. Please include a detailed description of the vulnerability, steps to reproduce, and any proof-of-concept code. Encrypt sensitive reports using our PGP key available upon request.

Our Commitment

  • We will acknowledge your report within 24 hours
  • We will provide regular updates on our progress
  • We will not pursue legal action against good-faith security researchers
  • We will credit researchers who help improve our security (with permission)

Scope

This policy applies to all IngressVC products, the ingressvc.com website, our API, and associated infrastructure. Please do not test against production systems without coordination. Do not access, modify, or delete data belonging to other users.

Compliance and Standards

SOC 2 Aligned

Our security controls are aligned with SOC 2 Type II criteria for security, availability, and confidentiality.

GDPR Compliant

We comply with the General Data Protection Regulation for all users, regardless of location.

PCI-DSS via Stripe

Payment processing is handled by Stripe, a PCI-DSS Level 1 service provider. Card data never touches our servers.

Regular Audits

We conduct regular security assessments, dependency audits, and penetration testing to identify and address potential vulnerabilities.