Security Policy

1. Introduction

At RaspberryPints, we take the security of your data and our services very seriously. This Security Policy outlines our commitment to protecting your information and the measures we implement to ensure the security, integrity, and availability of our services.

By using our services, you acknowledge and agree to the practices described in this Security Policy.

2. Our Security Commitment

We are committed to:

• Protecting the confidentiality, integrity, and availability of your data
• Implementing and maintaining appropriate technical, organizational, and physical safeguards
• Continuously monitoring and improving our security practices
• Responding promptly to security incidents
• Complying with applicable laws and regulations
• Providing transparency about our security practices

3. Data Security Measures

We employ multiple layers of security controls to protect our systems and your data:

3.1 Data Encryption

We use industry-standard encryption technologies to protect data both in transit and at rest:

• All data transmitted between your devices and our services is protected using TLS (Transport Layer Security) encryption
• Sensitive data stored in our databases is encrypted using AES-256 encryption
• We securely store encryption keys separate from the encrypted data

3.2 Infrastructure Security

Our infrastructure is designed with security in mind:

• We host our services on secure, trusted cloud infrastructure providers that maintain SOC 2, ISO 27001, and other relevant certifications
• We implement network security controls, including firewalls, intrusion detection systems, and network segmentation
• We regularly apply security patches and updates to our systems
• We employ redundant systems and data backups to ensure availability

3.3 Access Controls

We implement strict access controls to limit who can access our systems and your data:

• Employee access to systems and data follows the principle of least privilege
• We require multi-factor authentication for all staff accessing internal systems
• We maintain detailed access logs and regularly review them for suspicious activity
• We implement formal processes for granting, changing, and revoking access

3.4 Physical Security

We ensure physical security for our operations:

• Our office locations maintain physical access controls
• Our data centers employ 24/7 security personnel, video surveillance, intrusion detection, and multi-factor access authentication
• We maintain environmental controls to protect against fires, floods, and power outages

4. Application Security

We develop and maintain our software with security as a priority:

• We follow secure coding practices throughout development
• We use automated dependency and vulnerability scanning on our codebase
• Changes are security reviewed before release as part of our development process

We do not currently engage third-party penetration testers. If that changes, we will say so here.

4.1 Brewery Management Software

Our brewery management software includes the following security features:

• Role-based access control with customizable permissions
• Secure multi-tenant architecture that prevents data leakage between brewery accounts
• Audit logging of critical actions for transparency and accountability
• Timeout and automatic logout features

4.2 FlowBox Hardware Security

Our FlowBox hardware includes security measures:

• Devices communicate with our cloud services over TLS
• Each device authenticates to our API with its own credentials, scoped to a single brewery
• Devices report pour and tap telemetry only. They do not process personal information

FlowBox firmware does not currently implement ESP32 secure boot or cryptographically signed over-the-air updates. Both are planned before general availability, and we will update this section when they ship.

4.3 TV and Device Applications

Our Fire TV application is a kiosk-mode wrapper around your public taplist. It stores only the brewery subdomain you enter, locally on the device, and connects to that subdomain over HTTPS. It does not collect personal information or transmit data to our servers. See the app privacy policy for details.

5. Authentication and Password Security

Authentication is handled by AWS Cognito rather than by our own code, so credential storage and verification are managed by AWS:

• We enforce strong password requirements (length, mixed case, numbers, and special characters)
• Passwords are stored and verified by AWS Cognito; we never receive or store your password
• Email verification is required to activate an account
• We provide a secure password reset flow
• Sessions are authenticated with JWTs validated on every API request

Multi-factor authentication is not currently available on RaspberryPints accounts. It is on our roadmap, and we will update this page when it ships rather than describe it before it exists.

We recommend that you:

• Use strong, unique passwords for your RaspberryPints account
• Enable multi-factor authentication when available
• Never share your account credentials
• Log out from shared devices
• Update your password regularly

6. Monitoring and Incident Response

We actively monitor our systems and have procedures in place to respond to security incidents:

• We use CloudWatch monitoring and alerting on our production infrastructure
• Critical actions in the brewery admin panel are audit logged
• We review incidents after the fact and fix the underlying cause

RaspberryPints is a small company and does not have a dedicated security team or a formally tested incident response plan. Security incidents are handled directly by our engineering team.

In the event of a security incident that affects your data, we will:

• Promptly investigate and contain the incident
• Notify affected users in accordance with applicable laws and regulations
• Provide relevant information and recommended actions
• Cooperate with law enforcement if necessary

7. Third-Party Security

We carefully select and monitor our third-party service providers:

• We consider security and privacy practices when choosing vendors
• We limit vendor access to only the data necessary to provide their service
• Our principal subprocessors are listed in our Privacy Policy, so you can see exactly who processes your data

8. Compliance

We adhere to applicable industry standards and regulations:

• We design our security controls with reference to widely used industry frameworks, including the NIST Cybersecurity Framework and CIS Controls
• We handle personal information in accordance with applicable data protection laws, including the GDPR, the CCPA as amended by the CPRA, and the Australian Privacy Act, as described in our Privacy Policy
• Card payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We do not store full payment card numbers on our systems

To be precise about what we have not done: RaspberryPints is not currently SOC 2 or ISO 27001 certified, and we do not undergo external compliance audits. Our cloud infrastructure providers hold those certifications for the underlying platform, but that is their certification and not ours. We would rather state this plainly than imply an assurance we cannot back up.

9. Reporting a Vulnerability

If you believe you have found a security vulnerability in RaspberryPints, please report it to security@raspberrypints.com. Include enough detail for us to reproduce the issue.

We will acknowledge your report, investigate, and keep you updated on our progress. We ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly, and that you avoid accessing or modifying other customers' data while testing. We will not pursue legal action against researchers who follow these guidelines in good faith. We do not currently operate a paid bug bounty program.

10. Your Role in Security

While we implement strong security measures, you also play an important role in security:

• Keep your account credentials secure
• Maintain up-to-date software and operating systems on devices you use to access our services
• Be vigilant about phishing attempts and suspicious communications
• Report suspected security issues promptly
• Use secure networks when accessing our services
• Follow our recommended security practices

11. Security Vulnerability Reporting

We appreciate the assistance of security researchers and the broader community in maintaining high security standards:

• If you discover a potential security vulnerability, please report it to security@raspberrypints.com
• Provide sufficient information to reproduce and validate the issue
• Allow reasonable time for us to investigate and address the issue
• Do not disclose the vulnerability publicly before we have had a chance to address it

We commit to:

• Acknowledging receipt of your vulnerability report in a timely manner
• Providing updates on our progress in addressing reported vulnerabilities
• Giving credit to security researchers who responsibly disclose vulnerabilities, if desired
• Not pursuing legal action against researchers who follow responsible disclosure principles

12. Changes to This Security Policy

We may update this Security Policy from time to time. The date at the top of this policy indicates when it was last revised. We will notify you of any material changes through our website or by other means.

13. Contact Us

If you have any questions or concerns regarding this Security Policy or our security practices, please contact us at:

RaspberryPints
Email: security@raspberrypints.com