Security is where GigPlux started. Our CEO leads it directly, and every product is designed with it in mind from the first line of code. This page explains how we protect data today and where we are honestly still building.
We treat security as part of how a product is built, not a layer bolted on before launch. That means least-privilege access, encrypted data by default, and code reviewed with an attacker's mindset. Our founder's background is in cybersecurity, so this is not an afterthought at GigPlux.
We are an early company. We will not claim certifications we do not hold or controls we have not implemented. Everything on this page is either in place today or clearly marked as a goal. If you need something specific for a review, ask us and we will answer directly.
We welcome reports from security researchers and treat them seriously.
If you believe you have found a vulnerability in any GigPlux product or system, email security@gigplux.com with enough detail for us to reproduce it. Please give us a reasonable window to investigate and fix the issue before making it public.
All traffic to and from our products runs over HTTPS using modern TLS. Connections are encrypted end to end, and we redirect insecure requests to secure ones. Strict transport policies keep browsers on encrypted connections.
Data stored by our products is encrypted at rest using industry-standard AES-256 through our infrastructure providers. Credentials and secrets are stored using strong one-way hashing, never in plain text.
We collect only what a product needs to work. Less stored data means less to protect and less at risk if something goes wrong.
Internal access follows least privilege. Team members only reach the systems their role requires, and access is reviewed as the team changes.
You can request access to or deletion of your personal data. See our Privacy Policy for how we handle and retain information.
We run on established cloud and hosting providers with their own strong physical and network security controls, rather than managing bare metal ourselves.
Production environments are separated from development, and important data is backed up so it can be restored if something fails.
We log and monitor for unusual activity so we can respond quickly, and we patch dependencies as security updates are released.
These are goals, not current certifications. We list them so you know our direction.
As our products reach general availability and our customer base grows, we plan to pursue a SOC 2 Type II examination of our security controls. We are building our practices with that framework in mind, but we do not hold a SOC 2 report today.
Longer term, we aim to formalize our information security management system against ISO 27001. This is a future goal that depends on company maturity, and we are not certified against it yet.
Whether you are reporting a vulnerability or completing a vendor review, reach the security team directly at security@gigplux.com.