Information
Security.

Security is a core part of how we design, develop, and operate software at Sea Of Silver Software Factory (SOS). We apply security practices both to our own systems and to the projects we deliver to our clients, following industry-recognized principles such as OWASP and the secure development lifecycle (SDLC).

The measures we apply to protect our own information and our clients' information include:

• Encryption in transit via HTTPS/TLS across all our sites and applications.
• Access control based on the principle of least privilege.
• Secure management of credentials and secrets, avoiding their exposure in source code.
• Code reviews and security testing (including manual and automated testing) before every release.
• Regular updates of dependencies and components to mitigate known vulnerabilities.
• Periodic backups and incident recovery plans.

If you discover a security vulnerability on our website or in any of our systems, we greatly appreciate you reporting it to us responsibly before disclosing it publicly. We ask that you:

• Send us a detailed report at seaofsilvercompany@gmail.com, including steps to reproduce the finding, potential impact, and evidence (screenshots, logs, or a PoC).
• Give us a reasonable amount of time to analyze and remediate the issue before disclosing it publicly.
• Avoid accessing, modifying, or deleting data that does not belong to you, and refrain from any testing that could degrade the service for other users (for example, denial-of-service attacks).
• Do not use the finding for exploitation, extortion, or personal gain.

We commit to confirming receipt of your report, keeping you informed of the progress of the fix, and publicly thanking you for your collaboration if you authorize it, to the extent of our ability.

SOS's own digital assets are considered in scope, including this website and the subdomains directly operated by us.

Out of scope: social engineering attacks against our team, massive brute-force attacks, denial of service (DoS/DDoS), spam, and any testing against third-party infrastructure (hosting providers, CDN, integrated third-party services) that is not directly owned by SOS.

When a security incident that could affect personal data is detected, we act in accordance with our Privacy Policy: we assess the impact, contain and remediate the cause, and notify affected individuals and, where applicable, the relevant authorities, within the timeframes required by applicable regulations.

As part of our cybersecurity services, we recommend our clients:

• Use multi-factor authentication on all administrative access.
• Keep operating systems, frameworks, and third-party libraries up to date.
• Perform security audits and penetration testing on a regular basis.
• Define an incident response plan and communicate it to the entire team.

To report a vulnerability or ask about our security practices, write to us at seaofsilvercompany@gmail.com. This document is periodically reviewed and updated to reflect improvements in our security processes.