Security

Legal

Security is core to Sigli. This page summarizes how we protect your data and our infrastructure.

Encryption

  • All API traffic is encrypted in transit (TLS 1.2+)
  • API keys are stored hashed; secrets are never logged
  • Data at rest is encrypted on our production databases

Authentication

API requests require a valid key passed via the X-API-Key header. Workspace pages require JWT authentication. Keys can be rotated from the API Keys dashboard.

Infrastructure

  • Production runs on isolated cloud environments with network segmentation
  • Regular dependency and vulnerability scanning in CI
  • Rate limiting and abuse detection on all public endpoints

Reporting vulnerabilities

Found a security issue? Please report it responsibly to help@sigli.dev. We aim to acknowledge reports within 48 hours.

Compliance

We are working toward SOC 2 Type II certification. Enterprise customers can request our security questionnaire and DPA.