Security & Compliance

1. Security Overview

International Pet Registry is committed to maintaining the highest standards of information security and data protection. We recognize that our users trust us with sensitive personal data, pet information, veterinary medical records, and payment information. This page outlines the comprehensive security measures, compliance frameworks, and organizational controls we implement to safeguard that trust.

Our security program is designed to align with internationally recognized standards and frameworks, including ISO 27001, ISO 27701, SOC 2, PCI DSS, and HIPAA-equivalent protections. We continuously monitor, test, and improve our security posture to address evolving threats.

2. ISO 27001 Alignment

IPR aligns its information security management system (ISMS) with the ISO/IEC 27001:2022 standard. This alignment includes:

• Risk Assessment: We conduct regular information security risk assessments to identify threats, vulnerabilities, and potential impacts to our information assets.
• Security Policies: We maintain a comprehensive set of information security policies and procedures covering access control, asset management, cryptography, physical security, operations security, communications security, and incident management.
• Annex A Controls: We implement controls from ISO 27001 Annex A as appropriate to our risk profile, including organizational controls, people controls, physical controls, and technological controls.
• Continuous Improvement: We operate a plan-do-check-act (PDCA) cycle for continuous improvement of our ISMS.
• Management Review: Senior management reviews the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness.

3. ISO 27701 Alignment

We extend our ISMS to include privacy information management in alignment with ISO/IEC 27701:2019. This covers:

• Privacy Impact Assessments: We conduct privacy impact assessments (PIAs) before implementing new features or processing activities that may affect personal data.
• Data Processing Records: We maintain detailed records of processing activities as required by GDPR Article 30.
• Privacy by Design: We incorporate privacy considerations into the design of systems and features from the outset, including data minimization, purpose limitation, and storage limitation.
• Data Subject Rights: We have documented procedures for handling data subject access requests, rectification requests, erasure requests, and other rights under applicable privacy laws.
• Cross-Border Transfers: We implement appropriate safeguards for international data transfers, including Standard Contractual Clauses and supplementary measures.

4. HIPAA-Equivalent Protections for Medical Records

While the Health Insurance Portability and Accountability Act (HIPAA) applies exclusively to human health information and does not govern veterinary records, IPR voluntarily implements HIPAA-equivalent security controls for all veterinary medical data stored in the Medical Passport feature. We believe pet medical records deserve the same level of protection as human health records.

• Access Controls: Only authorized veterinary professionals can create, view, or modify medical records. Access is granted on a need-to-know basis.
• Audit Trails: All access to medical records is logged with timestamps, user identifiers, and actions performed. Audit logs are immutable and retained for a minimum of 6 years.
• Encryption: Medical records are encrypted at rest using AES-256 encryption and in transit using TLS 1.3.
• Minimum Necessary Standard: We apply the minimum necessary principle, ensuring that users access only the medical information needed for their specific purpose.
• Business Associate Agreements: We maintain data processing agreements with all sub-processors that handle medical data, equivalent to HIPAA Business Associate Agreements.
• Breach Notification: In the event of a breach involving medical records, we follow notification procedures equivalent to the HIPAA Breach Notification Rule.

5. PCI DSS Compliance

IPR processes payments exclusively through Stripe, a PCI DSS Level 1 Service Provider — the highest level of payment security certification. This means:

• IPR servers never receive, process, store, or transmit cardholder data (credit card numbers, CVV codes, or PINs).
• All payment forms use Stripe Elements, which are hosted by Stripe in PCI-compliant iframes.
• Payment tokenization ensures that sensitive card data never touches our infrastructure.
• We maintain SAQ-A compliance for e-commerce merchants who fully outsource cardholder data functions.
• Stripe undergoes annual PCI DSS audits by a Qualified Security Assessor (QSA) and maintains its Level 1 certification.

6. SOC 2 Principles Alignment

IPR aligns its controls with the five Trust Service Criteria (TSC) defined by the AICPA for SOC 2:

• Security: Protection of system resources against unauthorized access through firewalls, intrusion detection, multi-factor authentication, and access controls.
• Availability: System availability maintained through redundancy, failover capabilities, disaster recovery plans, and performance monitoring.
• Processing Integrity: System processing is complete, valid, accurate, and authorized through input validation, error handling, and quality assurance.
• Confidentiality: Information designated as confidential is protected through encryption, access restrictions, and data classification.
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of in conformity with our Privacy Policy and applicable regulations.

7. Technical Security Measures

• Encryption at Rest: All data stored in our databases is encrypted at rest using AES-256 encryption, managed by Supabase's underlying infrastructure on AWS.
• Encryption in Transit: All data transmitted between users and our servers is encrypted using TLS 1.3. We enforce HTTPS across all endpoints with HSTS headers.
• Row-Level Security (RLS): Supabase Row-Level Security policies ensure that database queries return only data that the authenticated user is authorized to access. Every table has RLS policies enforced at the database level.
• API Rate Limiting: API endpoints are rate-limited to prevent abuse, brute-force attacks, and denial-of-service attempts.
• Input Validation: All user inputs are validated and sanitized to prevent SQL injection, cross-site scripting (XSS), and other injection attacks.
• Content Security Policy (CSP): We deploy strict Content Security Policy headers to mitigate XSS and data injection attacks.
• CORS Configuration: Cross-Origin Resource Sharing is configured to allow requests only from authorized origins.

8. Authentication Security

• Password Hashing: All passwords are hashed using bcrypt with a work factor of 10 or higher. Plaintext passwords are never stored.
• Session Management: Authentication sessions are managed through Supabase Auth using secure, httpOnly, sameSite cookies. Sessions have configurable expiration and automatic refresh mechanisms.
• OAuth 2.0: We support Google OAuth for secure third-party authentication, following OAuth 2.0 and OpenID Connect standards.
• CSRF Protection: All state-changing requests are protected against cross-site request forgery attacks.
• Account Lockout: Repeated failed login attempts trigger temporary account lockout and notification to the account holder.

9. Infrastructure Security

• Vercel Edge Network: Our application is deployed on Vercel's global edge network, benefiting from DDoS protection, automatic SSL, and geographic load distribution. Vercel maintains SOC 2 Type II compliance.
• Supabase Managed PostgreSQL: Our database is hosted on Supabase's managed PostgreSQL infrastructure, which runs on AWS with encryption at rest, automated backups, and point-in-time recovery. Supabase maintains SOC 2 Type II compliance.
• Network Isolation: Database access is restricted to authorized application connections. Direct database access is not available from the public internet.
• Automated Backups: Databases are backed up daily with point-in-time recovery capabilities. Backups are encrypted and stored in separate geographic regions.

10. Access Controls

• Role-Based Access Control (RBAC): Users are assigned roles (owner, shelter, vet, breeder, government, admin) that determine their access level. Permissions are enforced at both the application and database levels.
• Principle of Least Privilege: Users and system processes are granted only the minimum access necessary to perform their functions.
• Administrative Separation: Administrative access is restricted to a minimal number of authorized personnel. Administrative actions are logged and audited.
• Access Reviews: We conduct periodic reviews of access rights to ensure they remain appropriate and revoke access promptly when no longer needed.

11. Data Encryption

We employ a defense-in-depth encryption strategy:

• Data at Rest: AES-256 encryption for all data stored in PostgreSQL databases, file storage, and backups.
• Data in Transit: TLS 1.3 for all network communications. Older TLS versions are disabled.
• Key Management: Encryption keys are managed by our infrastructure providers (AWS KMS via Supabase) with regular key rotation.
• Sensitive Fields: Particularly sensitive data fields (e.g., certain medical record fields, NAAR reports) receive additional application-level encryption.

12. Vulnerability Management

• Dependency Scanning: Automated scanning of application dependencies for known vulnerabilities using industry-standard tools.
• Security Updates: Critical security patches are applied within 48 hours of release. High-severity patches are applied within 7 days.
• Code Review: All code changes undergo review before deployment, with security-focused review for changes affecting authentication, authorization, or data handling.
• Static Analysis: Automated static application security testing (SAST) is integrated into the development pipeline.

13. Incident Response

IPR maintains a documented incident response plan that includes:

• Detection: Automated monitoring and alerting for security events, including unauthorized access attempts, anomalous data access, and system anomalies.
• Classification: Incidents are classified by severity level (Critical, High, Medium, Low) with corresponding response timelines.
• Containment: Immediate containment measures to limit the scope and impact of the incident.
• Eradication & Recovery: Root cause analysis, system remediation, and restoration of affected services.
• Notification: Timely notification to affected users, regulatory authorities (within 72 hours for GDPR), and law enforcement as applicable.
• Post-Incident Review: Comprehensive review and documentation of lessons learned, with updates to security controls as needed.

14. Business Continuity

• Disaster Recovery: We maintain disaster recovery procedures with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
• Geographic Redundancy: Data is replicated across multiple availability zones through our infrastructure providers.
• Backup Strategy: Daily automated backups with point-in-time recovery. Backups are tested regularly to ensure recoverability.
• Failover: Automatic failover mechanisms ensure service continuity in the event of infrastructure failures.

15. Personnel Security

• Background Checks: Personnel with access to production systems and personal data undergo background verification.
• Security Training: All team members receive security awareness training upon joining and annually thereafter.
• Acceptable Use: All personnel are bound by acceptable use policies and confidentiality agreements.
• Offboarding: Access is revoked immediately upon departure, with all credentials deactivated and devices wiped or returned.

16. Third-Party Vendor Security

We evaluate and monitor the security posture of all third-party vendors:

• Supabase: SOC 2 Type II certified, ISO 27001 certified, HIPAA compliant. Provides encrypted database hosting, authentication services, and row-level security.
• Vercel: SOC 2 Type II certified. Provides secure application hosting with edge network distribution, DDoS protection, and automatic SSL.
• Stripe: PCI DSS Level 1 certified, SOC 2 Type II certified. Handles all payment card data processing with industry-leading security controls.
• Hostinger: Provides SMTP email services with TLS encryption for email transmission.

All vendors are bound by data processing agreements that include security requirements, data handling obligations, and breach notification commitments.

17. Penetration Testing

We conduct regular security assessments:

• Annual third-party penetration testing of the application and infrastructure.
• Continuous automated vulnerability scanning.
• Ad-hoc testing following significant feature releases or architectural changes.
• Findings are prioritized by severity and remediated according to our vulnerability management policy.

18. Certifications & Attestations

Current compliance status and certifications:

• GDPR: Compliant. Data Processing Agreements in place with all sub-processors.
• CCPA/CPRA: Compliant. Privacy rights mechanisms implemented for California residents.
• PIPEDA: Compliant. Consent mechanisms and privacy rights implemented for Canadian residents.
• PCI DSS: SAQ-A compliant (via Stripe). No cardholder data processed or stored.
• ISO 27001: Aligned (formal certification planned).
• ISO 27701: Aligned (formal certification planned).
• SOC 2 Type II: Principles aligned. Sub-processors (Supabase, Vercel, Stripe) are SOC 2 certified.
• HIPAA-Equivalent: Voluntary implementation of HIPAA-equivalent controls for veterinary medical records.

19. Reporting Security Vulnerabilities

We value the security research community and encourage responsible disclosure of security vulnerabilities. If you believe you have discovered a security vulnerability in our Service, please report it to:

• Email: security@internationalpetregistry.net
• Subject: Security Vulnerability Report

Please include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce the vulnerability.
• Any proof-of-concept code or screenshots.
• Your contact information for follow-up questions.

We commit to acknowledging receipt within 48 hours and providing a substantive response within 10 business days. We will not pursue legal action against researchers who follow responsible disclosure practices, and we ask that you not access or modify data belonging to other users.