GILNEX Security Policy

Last Updated: July 12, 2026

GILNEX operates a defense-in-depth security program aligned with the OWASP Top 10 and SOC 2 principles. This page summarizes the safeguards that protect your data and supplements our Privacy Policy.

1. Encryption

All traffic is served over HTTPS with TLS 1.3. Data is encrypted in transit, and sensitive data (including authentication secrets) is encrypted at rest with AES-256.

2. Access Control

Access to production systems follows least-privilege principles, requires multi-factor authentication (MFA), and is logged and reviewed. Administrative actions are recorded in an audit trail.

3. Infrastructure & Payments

The Platform runs on reputable cloud providers (hosting, edge/CDN, and payments) with network isolation, rate limiting, and automated patching. GILNEX does not store payment card data — checkout is processed by Stripe (PCI DSS Level 1); card details never touch GILNEX servers.

4. Monitoring & Resilience

We monitor for anomalies, maintain encrypted backups, and test recovery. Vulnerabilities are triaged and remediated on a risk-based schedule.

5. Incident Response

If a security incident affects your data, we follow our Incident Response process, including notification consistent with California law (and your Business Associate Agreement, where applicable). See the Incident Response Policy.

6. Responsible Disclosure

Found a vulnerability? Report it to [email protected]. We investigate all good-faith reports and will not pursue researchers who act responsibly.

GILNEX follows SOC 2-aligned practices. "SOC 2-aligned" describes our control design; it is not a claim of a completed third-party SOC 2 audit.