Trust CenterSecurity
Security practices
The security posture of an MSP that operates critical infrastructure for hospitality, SMBs and remote operations. No invented audits.
This page describes real processes and commitments. When something isn't done yet — like an independent external pentest — we say so explicitly instead of implying otherwise.
Encryption in transit and at rest
All traffic travels encrypted; sensitive data is also encrypted where it is stored.
- TLS 1.2/1.3 is mandatory across all site and API traffic, served at the edge by Vercel and Cloudflare.
- Payment data is tokenized on the Stripe / MercadoPago side; DITAP never sees or stores full card numbers.
- Managed databases (Supabase / Postgres) encrypt data at rest by default at the provider's infrastructure layer.
- Application secrets (API keys, tokens, webhooks) live in environment variables managed by the hosting provider — never in the code repository.
Access control
Least-privilege access, multi-factor authentication and periodic permission reviews.
- Least-privilege principle: every person and every integration accesses only what their role requires.
- Multi-factor authentication (MFA) is mandatory on administrative accounts for hosting, DNS, payments and email.
- Client access to their own dashboards (for example /status) is segmented from internal administrative access.
- Periodic review of active access and immediate revocation when a collaboration or project ends.
Patch management
Dependencies and operating systems updated continuously, prioritizing critical vulnerabilities.
- Dependencies for the site and managed systems are updated continuously; critical vulnerability alerts are prioritized over the rest of the backlog.
- On client on-site infrastructure (switches, firewalls, access points), maintenance includes firmware updates on the manufacturer's schedule.
- Infrastructure changes go through version control and, where applicable, a staging environment before production.
Backups and continuity
Automated backups and tested recovery plans, with RTO/RPO agreed per project.
- Managed databases have automated daily backups and point-in-time recovery provided by the infrastructure vendor.
- In managed infrastructure projects, we define recovery time objectives (RTO) and recovery point objectives (RPO) together with the client based on service criticality.
- Network and critical system configurations are documented and version-controlled so they can be rebuilt after a hardware failure.
Vulnerability assessment & penetration testing
Honest posture: today we rely on our vendors' certifications and internal reviews; an independent pentest is under evaluation.
- We have not yet commissioned an independent external pentest on ditap.io — we won't claim otherwise. Commissioning one before scaling to enterprise clients is under evaluation.
- In the meantime, we rely on the security certifications and programs of our infrastructure vendors (Vercel, Cloudflare, Supabase, Stripe), which are independently audited.
- We run internal reviews of network configuration and attack surface on the managed infrastructure projects we deliver to clients.
- External vulnerability reports are received and handled per our responsible disclosure policy (/security/disclosure).
Incident response
A defined process for detection, containment, client communication and postmortem.
- Detection: error monitoring (Sentry) and service status monitoring (/status) with alerts to the responsible team.
- Triage and containment: severity classification and isolation of the affected component to limit impact.
- Communication: managed-SLA clients receive notification within the timeframes defined in /trust/sla based on severity.
- Postmortem: critical incidents are documented with root cause and corrective actions, shared with the affected client where applicable.
Vendor & sub-processor management
Every vendor that touches data is evaluated before onboarding and listed publicly.
- Before adding a vendor that processes data, we evaluate its privacy policy, certifications and international transfer mechanism (DPA / SCC).
- The full, up-to-date sub-processor list is published at /trust/sub-processors.
- Relevant changes to the sub-processor list are reflected on that page; material changes may be notified to clients under an active contract.
Need a specific technical detail for your vendor assessment?
We respond to security questionnaires and share additional documentation under NDA when appropriate.
Email [email protected]