Our Commitment to Security

As parents ourselves, we understand the importance of keeping your family's information safe. We've built Potty Training Pro with security as a top priority, implementing industry-leading practices to protect your data from unauthorized access, breaches, and cyber threats.

In Transit

• TLS 1.3 Encryption: All data transmitted between your device and our servers uses the latest Transport Layer Security protocol
• HTTPS Only: Our entire application runs exclusively over secure HTTPS connections
• Certificate Pinning: Mobile apps use certificate pinning to prevent man-in-the-middle attacks

At Rest

• Database Encryption: All data stored in our PostgreSQL databases is encrypted at rest using AES-256 encryption
• Password Hashing: User passwords are hashed using Argon2, the winner of the Password Hashing Competition and recommended by OWASP
• No Plain Text Storage: We never store sensitive information in plain text

• Principle of Least Privilege: Team members only have access to data necessary for their role
• Multi-Factor Authentication: All admin accounts require MFA for access
• Audit Logging: Every access to user data is logged and monitored
• Secure Authentication: Session tokens expire automatically and cannot be reused
• IP Whitelisting: Database access restricted to authorized IP addresses only

• Secure Cloud Hosting: Hosted on enterprise-grade infrastructure with 99.9% uptime SLA
• Automated Backups: Daily encrypted backups stored in geographically distributed locations
• DDoS Protection: Advanced protection against distributed denial-of-service attacks
• Firewall Protection: Web application firewall (WAF) blocks malicious traffic
• Vulnerability Scanning: Automated scanning for known vulnerabilities
• Isolated Environments: Production, staging, and development environments are completely separated

Application Security

• Input Validation: All user input is validated and sanitized to prevent injection attacks
• SQL Injection Prevention: Parameterized queries protect against SQL injection
• XSS Protection: Content Security Policy headers prevent cross-site scripting attacks
• CSRF Protection: Tokens prevent cross-site request forgery
• Rate Limiting: API rate limits prevent abuse and brute-force attacks
• Secure Dependencies: Regular updates and scanning of third-party libraries

Payment Security

• PCI Compliance: Payment processing meets Payment Card Industry Data Security Standards
• Tokenization: Card numbers replaced with secure tokens
• 3D Secure: Additional authentication layer for card transactions

In the unlikely event of a security incident:

• Immediate Action: Our 24/7 monitoring systems detect and alert our team instantly
• Rapid Response: Dedicated incident response team investigates and contains threats
• Transparent Communication: Where required by applicable law, affected users will be notified within legally mandated timeframes (typically within 72 hours)
• Post-Incident Review: Detailed analysis to prevent future incidents
• Law Enforcement Cooperation: We work with authorities when necessary

• Background Checks: All team members undergo background screening
• Security Training: Regular training on data protection and security best practices
• Confidentiality Agreements: All employees sign NDAs protecting user data
• Device Security: Company devices encrypted and remotely wipeable
• Immediate Revocation: Access removed immediately upon employee departure

Third-Party Vendors

We carefully vet all third-party services:

• Security Assessments: All vendors undergo security review before integration
• Data Processing Agreements: Legally binding contracts protect your data
• Minimal Access: Vendors only receive data necessary for their specific function
• Regular Audits: Ongoing monitoring of vendor security practices

Your Security Responsibilities

While we protect your data on our end, here's how you can help keep your account secure:

• Strong Passwords: Use unique, complex passwords (minimum 8 characters)
• Don't Share Login: Never share your password with anyone
• Sign Out: Always sign out when using shared devices
• Beware Phishing: We'll never ask for your password via email
• Report Suspicious Activity: Contact us immediately if you notice unusual account activity

Continuous Improvement

Security is not a one-time effort. We continuously monitor emerging threats, update our systems, and implement new security measures to stay ahead of cyber criminals. Our security practices are reviewed and updated regularly.

Report a Security Concern