Security

This document applies to the service inquiry, member account, and sample report features of the Company's website. Security terms for the analysis services that the Company provides to client companies under separate contracts are set out in those contracts.

HTTPS (TLS) is applied to every connection to the website, and connections made over HTTP are automatically redirected to HTTPS. Certificates are issued and renewed automatically by the hosting provider.

The following security headers are applied to every response.

• Blocking of file type sniffing (X-Content-Type-Options: nosniff)
• Blocking of framing by other sites (X-Frame-Options: DENY, CSP frame-ancestors 'none')
• Minimization of the referrer information sent to other sites (Referrer-Policy: strict-origin-when-cross-origin)
• Blocking of access to the camera, microphone, and location (Permissions-Policy)

Member authentication is handled by Supabase Auth, and passwords are stored as one-way hashes, so even the Company cannot know the original password.

Only accounts that have completed email verification can log in.

Destinations after login are restricted to paths within the website to prevent attacks that lure users to external sites (open redirects).

Sample report files are not stored in a public path. For each download request, the server verifies the login session before sending the file, and responses are configured so that they are not cached by browsers or intermediate servers.

Inputs to the service inquiry form are validated on the server for format and length, and control characters such as line breaks are removed from values used in email subjects to prevent email header injection.

Inquiry requests from the same IP address are limited to five per minute, and an input field that is invisible to people is used to filter out automated submission programs.

Secret keys for service integrations are managed only as environment variables in the deployment environment and are never included in the source code or repository. The open-source libraries in use are checked for updates, which are then applied.

The Company uses Vercel for hosting, Supabase for member authentication, and Resend for delivering inquiry emails. The personal information outsourced to each provider and the details of cross-border transfers are described in Articles 5 and 6 of the Privacy Policy.

The Company does not currently hold external security certifications such as ISO/IEC 27001 or SOC 2, and does not operate regular penetration testing or a bug bounty program. Security incident response is overseen by the Chief Privacy Officer, without a separate dedicated team.

If you discover a security vulnerability, please let us know at contact@dillab.ai. Including the affected URL, steps to reproduce, and the expected impact will help us verify the report.

During verification, please refrain from accessing or altering other users' information and from any testing that causes service disruptions.

Upon receiving a report, the Company will acknowledge receipt within five business days and inform you of the results of its review.

If the Company becomes aware of a security incident such as a personal information breach, it will take measures to prevent further damage, notify the affected data subjects, and report to the relevant authorities in accordance with applicable laws.