@{
    ViewData["Title"] = "Security";
}

<div class="container py-5" style="max-width:860px">

    <h1 class="h3 fw-bold mb-1"><i class="bi bi-shield-check me-2 text-primary"></i>Security at Powder Coating Logix</h1>
    <p class="text-muted small mb-4">Last Updated: April 9, 2026</p>

    <p class="lead mb-5">
        Your business data and your customers' data are the most important things you've trusted us with.
        Here is how we protect them.
    </p>

    <div class="row g-4 mb-5">
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-lock-fill text-primary me-2"></i>Encryption</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>In transit:</strong> All communication between your browser and our servers is encrypted using TLS 1.2 or higher. HTTP is automatically redirected to HTTPS.</li>
                        <li class="mb-1"><strong>At rest:</strong> Databases and file storage are encrypted using AES-256 via Microsoft Azure's native encryption.</li>
                        <li><strong>Passwords:</strong> Stored as bcrypt hashes &mdash; we never store or see your plain-text password.</li>
                    </ul>
                </div>
            </div>
        </div>
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-building text-primary me-2"></i>Infrastructure</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>Hosted on Microsoft Azure</strong> &mdash; enterprise-grade cloud infrastructure with SOC 2 Type II, ISO 27001, and FedRAMP certifications.</li>
                        <li class="mb-1"><strong>Geo-redundant storage</strong> ensures your data is replicated across multiple data centers.</li>
                        <li><strong>Daily automated backups</strong> with 7-day retention.</li>
                    </ul>
                </div>
            </div>
        </div>
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-people-fill text-primary me-2"></i>Access Controls</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>Role-based permissions:</strong> Each user in your account has a role that limits what they can see and do &mdash; Admins, Managers, Employees, Shop Floor, and Read-Only.</li>
                        <li class="mb-1"><strong>Multi-tenancy isolation:</strong> Your data is logically isolated from all other customers at the database level via row-level filtering.</li>
                        <li><strong>Internal access:</strong> Platform engineers access production data only when required for support, under the principle of least privilege.</li>
                    </ul>
                </div>
            </div>
        </div>
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-credit-card-fill text-primary me-2"></i>Payment Security</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>Stripe handles all payment processing.</strong> We never see, store, or transmit your card numbers &mdash; Stripe's PCI DSS Level 1 certified infrastructure handles that directly.</li>
                        <li class="mb-1"><strong>Stripe Connect</strong> is used for online invoice payments, meaning funds flow directly to your Stripe account.</li>
                        <li>Stripe's security details: <a href="https://stripe.com/docs/security" target="_blank" rel="noopener noreferrer">stripe.com/docs/security</a></li>
                    </ul>
                </div>
            </div>
        </div>
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-shield-lock-fill text-primary me-2"></i>Authentication</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>Strong password requirements:</strong> Minimum 8 characters with uppercase, lowercase, digit, and special character.</li>
                        <li class="mb-1"><strong>Two-factor authentication (2FA):</strong> Available for all user accounts via authenticator app.</li>
                        <li class="mb-1"><strong>Anti-brute-force rate limiting</strong> on login and registration endpoints.</li>
                        <li><strong>CSRF protection</strong> on all state-changing forms.</li>
                    </ul>
                </div>
            </div>
        </div>
        <div class="col-md-6">
            <div class="card h-100 border-0 shadow-sm">
                <div class="card-body">
                    <h5 class="card-title fw-semibold"><i class="bi bi-eye-fill text-primary me-2"></i>Monitoring &amp; Logging</h5>
                    <ul class="small mb-0">
                        <li class="mb-1"><strong>Structured application logging</strong> via Serilog with daily log rotation.</li>
                        <li class="mb-1"><strong>Azure Monitor</strong> provides infrastructure-level anomaly detection and alerting.</li>
                        <li class="mb-1"><strong>Audit logs</strong> record key administrative actions within your account.</li>
                        <li>System administrators receive real-time alerts for critical errors.</li>
                    </ul>
                </div>
            </div>
        </div>
    </div>

    <section class="mb-5">
        <h2 class="h5 fw-bold border-start border-primary border-3 ps-3 mb-3">Application Security Practices</h2>
        <ul>
            <li class="mb-1"><strong>SQL injection prevention:</strong> All database access uses Entity Framework Core with parameterized queries.</li>
            <li class="mb-1"><strong>XSS prevention:</strong> All user-supplied content is HTML-encoded by default via Razor's automatic escaping.</li>
            <li class="mb-1"><strong>Content Security Policy (CSP):</strong> HTTP headers restrict which scripts and resources can load on our pages.</li>
            <li class="mb-1"><strong>HSTS:</strong> HTTP Strict Transport Security enforced to prevent protocol downgrade attacks.</li>
            <li class="mb-1"><strong>Secure file uploads:</strong> File type validation and path traversal protection on all upload endpoints.</li>
            <li class="mb-1"><strong>Dependency updates:</strong> NuGet packages reviewed and updated regularly to address known vulnerabilities.</li>
        </ul>
    </section>

    <section class="mb-5">
        <h2 class="h5 fw-bold border-start border-primary border-3 ps-3 mb-3">Third-Party Security</h2>
        <p>
            We rely on the following vendors for core functionality, each of which maintains their own security programs:
        </p>
        <ul>
            <li><strong>Microsoft Azure</strong> &mdash; ISO 27001, SOC 2, FedRAMP</li>
            <li><strong>Stripe</strong> &mdash; PCI DSS Level 1</li>
            <li><strong>SendGrid / Twilio</strong> &mdash; ISO 27001, SOC 2</li>
            <li><strong>Anthropic</strong> &mdash; Enterprise AI security program</li>
        </ul>
    </section>

    <section class="mb-5">
        <h2 class="h5 fw-bold border-start border-primary border-3 ps-3 mb-3">Your Responsibilities</h2>
        <p>Security is a shared responsibility. You can help protect your account by:</p>
        <ul>
            <li>Using a strong, unique password and enabling 2FA;</li>
            <li>Not sharing login credentials between users &mdash; each person should have their own account;</li>
            <li>Assigning the minimum role necessary for each user's job;</li>
            <li>Revoking access promptly when an employee leaves;</li>
            <li>Reporting suspicious activity immediately.</li>
        </ul>
    </section>

    <section class="mb-5">
        <h2 class="h5 fw-bold border-start border-primary border-3 ps-3 mb-3">Responsible Disclosure</h2>
        <p>
            If you believe you have found a security vulnerability in Powder Coating Logix, please report it
            responsibly by emailing <a href="mailto:security@powdercoatinglogix.com">security@powdercoatinglogix.com</a>.
            We ask that you:
        </p>
        <ul>
            <li>Give us reasonable time to investigate and remediate before any public disclosure;</li>
            <li>Not access, modify, or delete data belonging to other users;</li>
            <li>Not perform denial-of-service testing.</li>
        </ul>
        <p>
            We will acknowledge your report within 2 business days and work with you to understand and address
            the issue. We appreciate responsible security research.
        </p>
    </section>

    <section class="mb-5">
        <h2 class="h5 fw-bold border-start border-primary border-3 ps-3 mb-3">Questions</h2>
        <p>
            For security questions or concerns, contact us at
            <a href="mailto:security@powdercoatinglogix.com">security@powdercoatinglogix.com</a>.
        </p>
    </section>

    <hr />
    <p class="text-muted small text-center mt-4">
        &copy; @DateTime.UtcNow.Year Powder Coating Logix &nbsp;&middot;&nbsp;
        <a asp-controller="Home" asp-action="TermsOfService" class="text-decoration-none">Terms of Service</a> &nbsp;&middot;&nbsp;
        <a asp-controller="Home" asp-action="Privacy" class="text-decoration-none">Privacy Policy</a>
    </p>

</div>
