Security Standards

Last updated November 4, 2026

This page summarizes the safeguards SponsorWell applies to customer data. It is informational and does not create contractual obligations; binding commitments live in the Terms of Service and the Data Processing Agreement.

Infrastructure

• Hosted on managed cloud infrastructure with encryption in transit (TLS) and encryption at rest.
• Production systems are isolated from other environments, and operator access follows least privilege.

Authentication and access control

• Passwordless authentication by email magic link and Google sign-in — no passwords are stored.
• Tenant data is isolated and enforced server-side; every request is authorized against tenant membership.
• Platform administration is restricted to a small set of SHIP IT Inc. operators.

Payments

• Card data is handled exclusively by Stripe; SponsorWell never stores card numbers.

Monitoring and continuity

• Application monitoring and error tracking are in place.
• Database backups are managed by the hosting provider.

Responsible disclosure

Report suspected vulnerabilities to security@sponsorwell.io. We investigate reports promptly and coordinate disclosure.