🔐 AllyFeed Security

Last updated: April 11, 2025

At AllyFeed, your data's security is our highest priority. We are committed to using modern encryption standards, best security practices, and secure infrastructure to protect your information every step of the way.

Infrastructure

AllyFeed is hosted on Google Cloud Platform, leveraging its globally trusted infrastructure:

  • Services deployed on Cloud Run with isolated staging/production environments
  • Data stored in Cloud SQL and Memorystore via private VPC access
  • Media and logs stored securely in Cloud Storage

Encryption Standards

All data is encrypted both in transit and at rest:

  • In transit: TLS 1.2+
  • At rest: AES-256 encryption using Google-managed keys
  • App Store and Play credentials: encrypted via Google Cloud Key Management Service (KMS)

Credential Access & AI Usage

AllyFeed uses App Store and Google Play credentials strictly for retrieving review data.
- Google Play: Uses scoped OAuth permissions (read-only).
- App Store: AppManager-level credentials are encrypted and accessed only when required.

AI-generated replies are never auto-published. You maintain full control and approval of every message.

Authentication & Authorization

  • All internal APIs are secured using OIDC-based identity via GCP service accounts
  • Microservices use Workload Identity with least privilege access
  • External users are authenticated via secure JWT sessions

Monitoring & Activity Logs

We monitor all access and service usage with GCP's native tools:

  • System logs and access attempts are tracked via Cloud Logging & Audit Logs
  • Alerts can be triggered on abnormal behavior
  • We monitor and throttle API abuse in real time

Compliance & Certifications

AllyFeed is built on Google Cloud, which is compliant with:

  • ISO 27001
  • SOC 2 & SOC 3
  • GDPR-ready infrastructure
  • HIPAA (upon request)

Questions?

We take security seriously. If you have any concerns or suggestions, reach out anytime.
Email: [email protected]