Security at IntBooks

Our security posture

• Encryption in transit. TLS 1.2+ on every connection, with HSTS preload on intbooks.my.
• Hosting. The application and its database run on servers we operate at Hetzner Cloud in Singapore; see the sub-processors list.
• Authentication. Clerk-managed sign-in, with multi-factor authentication available to every user.
• Authorisation. Per-organisation row-level security in Postgres; every query is filtered by organization_id. Production access by named engineers under MFA + audit log only.
• Backups. We don't publish a backup schedule or recovery-time commitment during the closed beta. You can request a full export of your data at any time.
• Network. Cloudflare in front of every public endpoint, with DDoS protection and rate limiting.
• Certifications. IntBooks does not yet hold SOC 2 or ISO 27001 certification, and no independent penetration-test report is available yet.

Responsible-disclosure programme

We thank security researchers who help us keep IntBooks safe. If you believe you have found a vulnerability, email security@intbooks.my with:

• A clear description of the vulnerability and its impact.
• A reliable reproduction (steps, payloads, screenshots, or video).
• Your name and a way to contact you for follow-up.
• Optionally, a PGP-signed mail (key on request).

We will acknowledge receipt within 2 business days and provide a triage decision within 10 business days. Do not publicly disclose the issue until we have shipped a fix or 90 days have passed, whichever comes first.

In scope

• https://intbooks.my (marketing site)
• https://app.intbooks.my (the IntBooks ERP application)
• https://api.intbooks.my (API gateway)

Out of scope

• Third-party services we depend on (Stripe, Clerk, Cloudflare). Report those directly to the vendor.
• Reports against best-practice header omissions without demonstrated impact.
• Self-service rate-limit bypass on free-tier features.
• Automated scanner output without manual validation.
• Social-engineering attacks against our staff.

Bounty & rewards

We do not yet operate a paid bounty programme. Eligible reporters of previously-unknown, in-scope vulnerabilities receive public credit (with consent) and IntBooks swag. Critical vulnerabilities ranked CVSS 9.0+ are eligible for a goodwill RM 1,500 reward at our discretion until a formal programme launches.

Acknowledgments

We are grateful to the researchers who have responsibly disclosed issues. Names are listed here with consent.

• The hall of fame is empty for now — be the first.

Status & incidents

We don't run a public status page yet. If an incident affects your data or your access, we notify affected customers directly by email, and personal-data breaches are handled under the notification duties in our privacy policy.