Security Policy

Last updated: July 2026

Protecting your data is core to how FreshCut NYC is built. This page summarizes the safeguards we apply and explains how to report a security problem. It complements our Privacy Policy, which describes what data we collect and why.

How we protect your data

Encryption in transit. All traffic to and from the Service is served exclusively over HTTPS/TLS, with HTTP Strict Transport Security (HSTS) enforced.
Payments & identity. Card payments and partner/driver payouts are handled by Stripe, a PCI-DSS Level 1 provider. Government-ID images for age verification are held by Stripe Identity. FreshCut never stores your full card number or ID images on its own servers.
Authentication. Passwords are hashed with bcrypt (never stored in plain text). Sessions can be revoked platform-wide when you change your password, delete your account, or an administrator acts on your account. Login, registration, and password-reset endpoints are rate-limited to deter brute-force and credential-stuffing attacks.
Access control. The platform enforces role-based access (customer, store partner, delivery worker, administrator) at both the edge and the API layer, so users can only reach the data and actions their role permits.
Application hardening. We apply a Content-Security-Policy, anti-clickjacking and MIME-sniffing headers, CSRF protections on state-changing requests, and server-side input validation on API endpoints.
Monitoring & audit. Security-relevant actions are recorded in an append-only audit log, and errors and anomalies are monitored so we can detect and respond to issues.
Data-protection law. We maintain administrative, technical, and physical safeguards consistent with the NY SHIELD Act, and we are building toward SOC 2 controls.

Breach notification

In the event of a data breach affecting your personal information, we will notify affected users and the appropriate authorities — including the New York Attorney General for New York residents — within the timeframes required by the NY SHIELD Act and other applicable law.

What you can do

Use a strong, unique password and never reuse it on other sites.
Keep your email account secure, since it can be used to reset access.
Verify your email address and keep your contact details current so we can reach you about security matters.
Beware of phishing — FreshCut will never ask for your password, full card number, or one-time codes by email, SMS, or phone.

Reporting a vulnerability

We welcome reports from security researchers. If you believe you have found a security vulnerability in the Service, please email security@freshcut.nyc with enough detail to reproduce the issue (affected URL or endpoint, steps, and impact). We aim to acknowledge reports within 3 business days and to keep you updated as we investigate and remediate.

Safe harbor for good-faith research

If you make a good-faith effort to comply with this policy during your research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you related to your report. We consider activities conducted consistent with this policy to be authorized conduct under the Computer Fraud and Abuse Act and analogous state law.

In scope

The FreshCut NYC web application and its public API.
Authentication, authorization, and access-control flaws.
Injection, cross-site scripting, CSRF, SSRF, and similar application vulnerabilities.
Sensitive-data exposure and insecure-configuration issues.

Out of scope / please do not

Access, modify, or delete data that is not your own; use test accounts you create.
Run denial-of-service, high-volume automated, or physical attacks, or social-engineer our staff, partners, drivers, or customers.
Report issues in third-party services (e.g., Stripe, Twilio, Cloudinary) here — report those to the respective provider.
Publicly disclose a vulnerability before we have had a reasonable opportunity to remediate it.

This program does not currently offer monetary bounties, but we are grateful for responsible disclosure and will credit researchers who wish to be acknowledged.

Contact

Security reports: security@freshcut.nyc. Privacy questions: privacy@freshcut.nyc.

How we protect your data

Encryption in transit. All traffic to and from the Service is served exclusively over HTTPS/TLS, with HTTP Strict Transport Security (HSTS) enforced.

Payments & identity. Card payments and partner/driver payouts are handled by Stripe, a PCI-DSS Level 1 provider. Government-ID images for age verification are held by Stripe Identity. FreshCut never stores your full card number or ID images on its own servers.

Authentication. Passwords are hashed with bcrypt (never stored in plain text). Sessions can be revoked platform-wide when you change your password, delete your account, or an administrator acts on your account. Login, registration, and password-reset endpoints are rate-limited to deter brute-force and credential-stuffing attacks.

Access control. The platform enforces role-based access (customer, store partner, delivery worker, administrator) at both the edge and the API layer, so users can only reach the data and actions their role permits.

Application hardening. We apply a Content-Security-Policy, anti-clickjacking and MIME-sniffing headers, CSRF protections on state-changing requests, and server-side input validation on API endpoints.

Monitoring & audit. Security-relevant actions are recorded in an append-only audit log, and errors and anomalies are monitored so we can detect and respond to issues.

Data-protection law. We maintain administrative, technical, and physical safeguards consistent with the NY SHIELD Act, and we are building toward SOC 2 controls.

What you can do

Use a strong, unique password and never reuse it on other sites.

Keep your email account secure, since it can be used to reset access.

Verify your email address and keep your contact details current so we can reach you about security matters.

Beware of phishing — FreshCut will never ask for your password, full card number, or one-time codes by email, SMS, or phone.

Reporting a vulnerability

Safe harbor for good-faith research

In scope

The FreshCut NYC web application and its public API.

Authentication, authorization, and access-control flaws.

Injection, cross-site scripting, CSRF, SSRF, and similar application vulnerabilities.

Sensitive-data exposure and insecure-configuration issues.

Out of scope / please do not

Access, modify, or delete data that is not your own; use test accounts you create.

Run denial-of-service, high-volume automated, or physical attacks, or social-engineer our staff, partners, drivers, or customers.

Report issues in third-party services (e.g., Stripe, Twilio, Cloudinary) here — report those to the respective provider.

Publicly disclose a vulnerability before we have had a reasonable opportunity to remediate it.

This program does not currently offer monetary bounties, but we are grateful for responsible disclosure and will credit researchers who wish to be acknowledged.