Security

• Traffic encrypted in transit (TLS); data encrypted at rest on managed infrastructure.
• Operator passwords stored as salted PBKDF2 hashes; sessions are random, expiring tokens.
• Webhooks verified by signature or shared secret; unsigned requests are rejected.
• Do-not-call and consent records are append-only in practice and never deleted.
• Third-party processors are limited to telephony (Twilio/Vapi), scheduling (Cal.com), and cloud hosting (Cloudflare).

To report a security issue, email leads@nostradamy.com.