Information Security
Whitepaper

2 Infrastructure Architecture

ALA operates a fully serverless architecture on Cloudflare's global edge network. This eliminates entire categories of traditional security concerns, including operating system vulnerabilities, server misconfigurations, and patch management overhead.

Compute Layer

All application logic runs on Cloudflare Workers, a V8 isolate-based serverless platform. Each request executes in an isolated context with no shared memory between invocations. There are no traditional servers, no virtual machines, and no operating system to patch or maintain.

Static Assets

Marketing sites, assessment interfaces, and documentation are served via Cloudflare Pages, a globally distributed static hosting platform with automatic HTTPS, cache invalidation, and edge delivery.

Data Storage

Global Distribution

All services are deployed across Cloudflare's 300+ edge locations worldwide. Traffic is automatically routed to the nearest point of presence via anycast networking. This architecture provides inherent redundancy with no single point of failure and no single-region dependency.

3 Data Classification

ALA classifies all data into four tiers based on sensitivity, with corresponding handling requirements for each classification level.

All personnel and automated systems are required to handle data according to its classification. Data classification is assigned at creation and reviewed periodically. Restricted data is never stored in source code repositories, transmitted in plaintext, or shared via unencrypted channels.

4 Encryption

ALA enforces encryption at every layer of the data lifecycle, from transmission to storage to processing.

Data in Transit

• Protocol: TLS 1.3 exclusively, managed by Cloudflare's edge network
• HSTS: HTTP Strict Transport Security enforced with a minimum max-age of one year, including subdomains
• Certificate Management: Automated via Cloudflare; certificates are provisioned, renewed, and rotated without manual intervention
• Minimum TLS Version: TLS 1.2 (TLS 1.0 and 1.1 disabled across all domains)

Data at Rest

• Algorithm: AES-256 encryption applied to all data stored in Cloudflare D1, KV, and R2
• Key Management: Encryption keys are managed by Cloudflare and are never exposed to ALA application code
• Backup Encryption: All backup data stored in R2 inherits the same AES-256 encryption

Payment Data

• Processor: Stripe, certified PCI DSS Level 1
• Scope: No credit card numbers, CVVs, or bank account details are transmitted to, processed by, or stored on ALA infrastructure
• Tokenization: Stripe handles all tokenization of sensitive payment data

5 Authentication & Access Control

ALA enforces strict authentication and authorization controls across all systems, following the principle of least privilege.

Infrastructure Access

• Cloudflare Dashboard: Multi-factor authentication (MFA) enforced for all accounts with infrastructure access
• API Tokens: Scoped to minimum required permissions; rotated on a regular schedule; never shared between services
• No Shared Credentials: Each administrator and each automated service uses a unique credential set

Administrative APIs

• Authentication: Bearer token authentication on all admin API endpoints
• IP Allowlisting: Applied where operationally feasible to restrict admin access to known networks
• Rate Limiting: All admin endpoints are rate-limited to prevent brute-force attacks

User-Facing Systems

• Assessments: Session-based access with no persistent PII storage beyond what is needed for result delivery
• No User Accounts: ALA assessment products do not require user account creation, minimizing the PII footprint
• Result Access: Assessment results are delivered via unique, time-limited verification codes

6 Network Security

ALA's network security posture leverages Cloudflare's enterprise network protection, which processes an average of 57 million HTTP requests per second globally and mitigates some of the largest DDoS attacks on the internet.

DDoS Protection

Cloudflare provides unmetered, always-on DDoS mitigation across all ALA domains. Volumetric, protocol, and application-layer attacks are absorbed at the edge before reaching application logic. There is no additional cost for attack mitigation regardless of attack size or duration.

Web Application Firewall (WAF)

Cloudflare's managed WAF ruleset is enabled across all ALA domains, providing protection against OWASP Top 10 vulnerabilities, zero-day exploits, and emerging threat patterns. Rules are updated continuously by Cloudflare's threat intelligence team.

Additional Controls

7 Application Security

ALA's application code follows secure development practices designed to prevent common vulnerability classes.

Input Validation

All user-supplied input is validated on the server side before processing. Form submissions, API parameters, and query strings are sanitized and type-checked. No user input is trusted implicitly.

Injection Prevention

• SQL Injection: All database queries use parameterized statements via D1's prepared statement API. No string concatenation is used to construct queries.
• XSS Prevention: All dynamic content is escaped before rendering. Content Security Policy (CSP) headers are enforced to prevent inline script execution and restrict resource origins.
• No Dynamic Execution: The codebase prohibits the use of eval(), Function() constructors, and any form of dynamic code execution.

HTTP Security Headers

CORS Configuration

Cross-Origin Resource Sharing (CORS) policies are configured on a per-endpoint basis with explicit origin allowlists. Wildcard origins are never used on authenticated or sensitive endpoints.

8 Data Handling & Privacy

ALA's data handling practices are designed to minimize the collection, retention, and exposure of personally identifiable information.

Assessment Data Lifecycle

1. Collection: Assessment responses are collected during the testing session via a secure, encrypted connection.
2. Processing: Responses are scored in real time on Cloudflare Workers. Individual question-level responses are processed in memory.
3. Retention: Aggregate scores and performance metrics are retained for result delivery. Individual question responses are discarded after scoring and are not stored in any persistent database.
4. Delivery: Results are delivered to the user via a unique verification code. Reports are generated on demand.

Data Minimization

ALA collects only the minimum data necessary to deliver its services. No browsing history, device fingerprints, or behavioral tracking data is collected or stored. Analytics are aggregate and anonymized.

Privacy Compliance

Subprocessor Data Sharing

No PII is shared with subprocessors beyond what is strictly required for service delivery. Stripe receives only the data necessary to process payments. Mailgun receives only the email address and content required for transactional email delivery. No data is sold, rented, or shared for advertising purposes.

9 Payment Security

ALA has architected its payment infrastructure to ensure that no sensitive financial data ever enters ALA-controlled systems.

Payment Processor

All payment processing is handled exclusively by Stripe, which maintains PCI DSS Level 1 certification — the highest level of payment security certification available. Stripe processes hundreds of billions of dollars annually and undergoes rigorous annual audits by a PCI Qualified Security Assessor.

Architecture

• Stripe Checkout / Payment Links: Customers are redirected to Stripe-hosted payment pages. No credit card form fields exist on ALA-controlled pages.
• No Card Data: Credit card numbers, CVVs, expiration dates, and bank account information never touch ALA infrastructure at any point in the transaction lifecycle.
• Webhook Security: All Stripe webhook callbacks are verified using Stripe's webhook signature verification to prevent spoofed or tampered events.
• Token-Based: Post-payment references use Stripe's opaque tokens. ALA stores only transaction IDs and payment status, never raw financial data.

10 Backup & Recovery

ALA maintains a comprehensive automated backup system to ensure data durability and rapid recovery.

Backup Scope

Retention Strategy

• Primary Backup: 4-quarter rotation in Cloudflare R2, ensuring multiple recovery points
• Offsite Backup: Daily replication to separate storage infrastructure with 30-day retention
• Large Database Handling: Multipart upload support for databases exceeding standard size limits

Recovery Objectives

Restoration Process

Automated restoration scripts enable rapid recovery from any backup point. Restoration can be initiated by authorized administrators and targets individual databases or full-system recovery as required.

11 Incident Response

ALA maintains a documented incident response plan that defines classification, response procedures, communication requirements, and post-incident review processes.

Incident Classification

Response Procedure

1. Detection & Identification: Incident is detected via monitoring, automated alerts, or manual report
2. Containment: Immediate actions to limit the scope and impact of the incident
3. Eradication: Root cause is identified and eliminated from all affected systems
4. Recovery: Affected services are restored to normal operation with verification
5. Post-Incident Review: Formal review conducted within 5 business days; lessons learned documented and remediation actions assigned

Breach Notification

In the event of a confirmed data breach involving personal information, affected parties will be notified within 72 hours of confirmation. Notification will include the nature of the breach, the data involved, actions taken, and recommended steps for affected individuals. Regulatory authorities will be notified as required by applicable law.

12 Business Continuity / Disaster Recovery

ALA's business continuity and disaster recovery capabilities are inherent to its serverless architecture on Cloudflare's global network.

Inherent Redundancy

Cloudflare's global anycast network automatically routes traffic to the nearest healthy point of presence. If any data center becomes unavailable, traffic is seamlessly rerouted to the next-nearest location with no manual intervention and no perceptible service interruption for end users.

Key BC/DR Capabilities

• No Single-Region Dependency: Application code and data are distributed across Cloudflare's 300+ global locations
• Automated Failover: Zero manual intervention required for infrastructure failover events
• No Hardware Dependency: No physical servers, network appliances, or storage arrays that could fail
• Instant Deployment: Application updates deploy globally in under 60 seconds, enabling rapid hotfix deployment

Testing

Business continuity and disaster recovery procedures are tested quarterly via simulated outage scenarios. Tests validate backup restoration procedures, failover behavior, and recovery time objectives. Results are documented and any identified gaps are remediated.

13 Vendor / Subprocessor Security

ALA limits its subprocessor relationships to a small number of enterprise-grade vendors, each of which maintains independently audited security certifications.

Vendor Review Process

• All subprocessors are reviewed annually for continued compliance with ALA's security requirements
• Security certifications and audit reports are verified during each review cycle
• Data processing agreements (DPAs) are maintained with all subprocessors that handle user data
• New subprocessors undergo security assessment prior to integration

14 Compliance Framework Alignment

ALA aligns its security practices with established federal and industry compliance frameworks to ensure a robust and defensible security posture.

ALA continuously monitors regulatory developments and updates its compliance posture as new requirements emerge. All compliance-related documentation is maintained and available for review by authorized parties upon request.

15 Insurance Coverage

ALA maintains comprehensive insurance coverage to address residual risk and provide financial protection for the organization and its stakeholders.

Cyber liability coverage includes first-party and third-party protections covering data breach response costs, forensic investigation, notification expenses, credit monitoring, regulatory defense, and business interruption. Coverage is reviewed annually and adjusted as the organization's risk profile evolves.

16 Contact

For security inquiries, vulnerability reports, compliance questions, or to request additional documentation, contact:

ALA welcomes responsible disclosure of security vulnerabilities. If you believe you have identified a security issue in any ALA system, please contact us at the address above. We commit to acknowledging receipt within 24 hours and providing an initial assessment within 72 hours.