Security & Responsible Disclosure

These are properties of the code we run today, checked by automated tests:

• Separation between properties. Every request is tied to the signed-in person's property; a record of another property reads as "not found".
• Role-based access. Every route declares which roles may use it; a route without a rule is refused. Staff see only their assigned areas, residents only their own home.
• Passwords and sign-in. Passwords are stored only as bcrypt hashes. Repeated wrong passwords for one account are slowed down, sign-in only accepts requests from the Meurneoba OS web app, and sign-out ends the session on the server.
• Secrets. Integration and device keys are stored as hashes and shown once. Our code is scanned for passwords and keys before it is merged.
• Audit log. Changes are recorded with who, when and which fields, without storing the values people sent; entries are kept 400 days.
• Backups. The database is backed up nightly, encrypted, kept 30 days, and restores are tested.
• Hosting. The database and application servers are in Frankfurt, Germany, and all connections are encrypted.

We do not hold SOC 2 or ISO 27001 certification. If your organisation needs one, contact us before you start so we can discuss what we can provide.

The database runs on Neon and the application server on Render, both in Frankfurt, Germany; the web pages are served by Vercel. AI uses Anthropic models, encrypted backups are kept on GitHub, and Telegram delivers bot messages for people who link a chat. The full list and what each one receives is in the Privacy Policy.

We welcome reports from security researchers. To report a vulnerability:

• Email zuka@meurneoba.ge with a clear description, reproduction steps, the affected URL or endpoint, and the potential impact.
• Please give us a reasonable window to fix the issue before public disclosure. We aim to acknowledge reports within five business days.
• Do not access data that is not yours, do not run automated scanners that degrade service for other tenants, and do not exfiltrate data beyond what is necessary to demonstrate the issue.

Good-faith security research conducted under the rules above will not be pursued legally by Meurneoba. We will credit researchers who wish to be credited once a fix has been deployed.

• Reports based purely on missing security headers without a demonstrated impact.
• Denial-of-service attacks, including login-flood attempts against the rate limiter.
• Findings in third-party services we use (Neon, Render, Vercel, Anthropic, Telegram, OpenWeatherMap) that do not affect data inside Meurneoba.
• Vulnerabilities that require physical access to a user's unlocked device.

• An acknowledgement within five business days.
• A triage outcome (accepted, duplicate, out of scope) within ten business days.
• For accepted reports, status updates as the fix progresses and a notice when a fix is deployed.