Security & Compliance Architecture
How DreemFolio AI engineers zero-trust data protection, OWASP hardening, and cryptographic integrity across every layer.
TLS 1.3 & Bcrypt Hashing
Strict modern ciphers in transit. One-way salt hashing prevents credential compromise.
OWASP Hardened Middleware
Enforced security headers against Clickjacking, MIME-sniffing, XSS, and Referrer leakage.
Zero-Trust Server Validation
All PDF quotas, tier permissions, and admin operations are cryptographically verified server-side.
1 Application Security & OWASP Hardening
DreemFolio AI is built on an enterprise FastAPI framework hardened with mandatory HTTP security middleware:
Prevents clickjacking attacks by blocking unauthorized framing from third-party websites.
Disables MIME-type sniffing to eliminate drive-by executable downloads and cross-site scripting.
Restricts sensitive URL leakage across origins while enabling clean avatar loading via explicit referrerpolicy.
All MySQL database operations utilize parameterized SQLAlchemy 2.0 queries, eliminating SQL injection.
2 Authentication & Zero-Trust Verification
- Bcrypt Salt Hashing: User passwords undergo cryptographic key derivation with high cost factors. Plaintext passwords never touch logs or storage.
- HMAC-SHA256 JWT Tokens: Sessions are secured using JSON Web Tokens containing short expiration windows and validated cryptographic signatures.
- Google OAuth 2.0 GIS: Google tokens are verified via Google's public token verification certificates, with issuer (accounts.google.com), audience (client_id), expiration, and email-verification validation.
- Role-Based Access Control (RBAC): Administrative endpoints require active database flag verification (is_admin=True); front-end state cannot grant unauthorized access.
3 Authorized Sub-Processor Registry
To deliver our services, we partner with trusted infrastructure sub-processors who adhere to SOC 2, ISO 27001, and GDPR standards:
Enterprise AI model inference (Zero model training retention).
Encrypted user profiles and saved cloud resume storage.
PCI-DSS Level 1 compliant recurring billing & subscription management.
4 Vulnerability Reporting & Responsible Disclosure
If you discover a potential security vulnerability in our application, API, or infrastructure, please submit a responsible disclosure report to security@dreemfolio.com. We provide prompt triage, fast remediation, and acknowledgment in our security hall of fame.