Security Policy & Trust Center

This page summarizes, at a high level, how FindMe protects your account and data. It's meant to be a plain-language starting point, not an exhaustive technical audit.

It also covers how we protect identity verification data and how we limit access to sensitive documents.

Passwords are hashed with Argon2id, a modern, memory-hard hashing algorithm — we never store or can see your actual password. Sessions are managed through secure, signed cookies with automatic refresh.

Every table in our database enforces Row-Level Security, meaning access is checked at the database layer itself, not just in application code. Company workspaces are strictly isolated from one another — a request for another company's data returns 'not found,' never a hint that it exists.

Verification documents are stored separately from public profile data, protected by restricted access controls, and only exposed to authorized reviewers when needed.

Identity documents, selfies, and supporting files are encrypted in transit and at rest, and access is logged for audit purposes.

Reviewer access is limited to authorized staff with a legitimate business need, and sensitive verification actions are reviewed for unusual access patterns or misuse.

Sensitive actions are protected against cross-site request forgery via same-origin checks, and repeated authentication attempts are rate-limited to slow down automated attacks. Security-relevant events are recorded in an immutable audit log.

FindMe never stores your card details — all payment processing is handled by PayMongo, a PCI-DSS compliant payment processor, and billing webhook events are cryptographically signature-verified before we act on them.

If you believe you've found a security vulnerability, please contact us directly rather than disclosing it publicly, so we can investigate and fix it responsibly.