Security

At DeepValue, protecting the data you entrust to us is a core responsibility. This page describes the technical and organisational measures we have in place to keep your account, personal data, and research activity secure.

Security is an ongoing commitment. We continuously review and improve our practices as threats evolve and as we grow. If you discover a vulnerability, please see our Vulnerability Disclosure section below.

• •Our platform is hosted on reputable cloud infrastructure providers with SOC 2 Type II and ISO 27001 certifications.
• •Production systems run in isolated environments separated from development and staging.
• •We use firewalls and network-level access controls to restrict traffic to only what is necessary.
• •Regular automated backups are performed with point-in-time recovery capability. Backups are encrypted and stored in geographically separate locations.
• •Our infrastructure is monitored 24/7 with automated alerting for anomalous activity.

• •Internal access to production data follows the principle of least privilege — team members only access what they need for their role.
• •Access to sensitive systems requires multi-factor authentication (MFA).
• •All internal access is logged and audited.
• •Access rights are reviewed regularly and revoked promptly when no longer needed (e.g., when a team member leaves).
• •We do not allow shared credentials for production system access.

We provide the following safeguards for user accounts:

• •Passwords must meet minimum complexity requirements.
• •Failed login attempts trigger account lockout after repeated failures to prevent brute-force attacks.
• •Session tokens are rotated on login and invalidated on logout.
• •Suspicious login activity (e.g., login from a new device or location) may trigger an email notification.

We do not store, process, or transmit raw credit card data on our servers. All payment processing is handled by a PCI DSS-compliant third-party payment provider. What we store is only a tokenised reference to your payment method, never the full card details.

If you believe an unauthorised charge has occurred, contact us at klemen@deepvalue.tech immediately.

We apply industry-standard secure development practices, including:

• •Input validation and output encoding to prevent injection attacks (SQL injection, XSS, etc.).
• •Cross-Site Request Forgery (CSRF) protection on all state-changing endpoints.
• •Security-focused HTTP response headers (Content-Security-Policy, X-Frame-Options, etc.).
• •Rate limiting on authentication endpoints and public APIs to prevent abuse.
• •Honeypot fields and timing analysis on signup forms to mitigate bot submissions.
• •Dependency scanning and regular updates to patch known vulnerabilities in third-party libraries.
• •Code review processes that include security considerations before deployment.

We maintain an incident response plan to ensure we can react quickly and effectively to security events:

• •Security incidents are triaged and assigned severity levels immediately upon detection.
• •Affected systems are isolated to contain the impact of a potential breach.
• •In the event of a data breach affecting your personal information, we will notify you as required by applicable law — and in any case within 72 hours of becoming aware of the incident.
• •A post-incident review is conducted after every significant security event to identify root causes and prevent recurrence.

To report a vulnerability, email us at klemen@deepvalue.tech with the subject line Security Vulnerability Report. Please include:

• •A description of the vulnerability and its potential impact.
• •Steps to reproduce the issue.
• •Any proof-of-concept code or screenshots (if applicable).
• •Your contact details so we can follow up.

We will acknowledge your report within 3 business days and aim to resolve confirmed vulnerabilities as quickly as possible. We ask that you:

• •Give us reasonable time to investigate and remediate before any public disclosure.
• •Avoid accessing, modifying, or deleting data that does not belong to you.
• •Not perform any actions that could degrade the availability of the Service.

We appreciate the work of the security community and will credit responsible disclosures publicly (with your permission) after a fix is in place.

For any security-related questions or concerns, please contact us: