shield Effective August 2026

Security & Vulnerability Disclosure

Our security architecture and responsible disclosure policy for security researchers and the broader community.

1. Security Architecture

lock
Encryption at Rest

AES-256 for all personal data and creator content.

https
Encryption in Transit

TLS 1.3 for all connections between clients and infrastructure.

shield
DDoS Protection

Enterprise DDoS mitigation via Cloudflare's global anycast network.

manage_accounts
Role-Based Access Control

Strict RBAC ensuring minimum-privilege access for all personnel.

credit_card
PCI-DSS Level 1

Payment processing (Cashfree) at the highest PCI-DSS standard.

bug_report
Continuous Scanning

Automated vulnerability scanning and periodic third-party security audits.

2. Responsible Disclosure Policy

We appreciate the security research community's efforts to keep Peakime and our users safe. If you discover a security vulnerability, we ask that you follow responsible disclosure principles:

  • Report the vulnerability to us privately via [email protected] before any public disclosure.
  • Provide sufficient detail to reproduce and validate the issue (steps to reproduce, screenshots, proof-of-concept code where applicable).
  • Allow us a reasonable time period (we target 90 days) to investigate and remediate the issue before public disclosure.
  • Do not access, modify, or delete data that does not belong to you.
  • Do not perform denial-of-service attacks or disrupt services.

3. Our Response Commitment

When you report a vulnerability to us in good faith:

  • We will acknowledge receipt within 48 hours.
  • We will provide an initial assessment of severity and scope within 7 business days.
  • We will keep you informed of remediation progress.
  • We will not pursue legal action against researchers who follow this responsible disclosure policy.
  • We acknowledge qualifying security reports on our website (with your consent).

4. Contact