One Mipham

Information Security

Information security is the foundation of our products and operations. This page lists only what we currently implement. Capabilities we do not yet have are collected in the Roadmap section at the end, so they are not confused with measures already in place.

Our Security Commitment

Security is not an afterthought — it is a core principle embedded in every product design and every deployment from day one.

Data Protection Measures in Place

Transport Security

  • HTTPS site-wide, negotiating TLS 1.3 by default (mipham.ai returns TLS_AES_128_GCM_SHA256)
  • TLS 1.2 is still accepted for legacy clients — we have not yet enforced a 1.3 minimum
  • Certificates issued by a publicly trusted CA (Let's Encrypt)

Credentials and Configuration

  • Sensitive configuration such as payment merchant keys is injected via environment variables, never written into code, logs, or commit history
  • Production deployment credentials are not stored in any repository

Data Minimisation

  • We collect only the fields required to fulfil an order (order number, amount, product, optional phone number)
  • No third-party analytics, advertising, or tracking SDKs are embedded

Secure Development Lifecycle

  • All changes go through a feature branch and Pull Request; direct commits to main are prohibited
  • CI enforces lint / typecheck / build on both sites; changes are not merged while a check is failing
  • Third-party dependencies pass a licence compliance check before adoption (copyleft/GPL prohibited)
  • Commit messages follow Conventional Commits for traceability

Vulnerability Management

We maintain a responsible disclosure program. Security researchers may report potential vulnerabilities to security@onemipham.com.

We commit to:

  • Acknowledging reports within 48 hours
  • Assessing and prioritizing based on severity
  • Maintaining transparent communication on remediation progress
  • Not pursuing legal action against good-faith security research

Roadmap (Not Yet Implemented)

We do not yet have the following capabilities. They are listed explicitly so they are not mistaken for measures already in place:

  • Encryption of data at rest and Hardware Security Module (HSM) key management — order records are kept in a local file on the server and are not encrypted at rest
  • Mandatory multi-factor authentication (MFA), role-based least-privilege access (RBAC/ABAC), and access approval workflows
  • Independent third-party security audits, penetration testing, and SOC 2 / ISO 27001 certification
  • Automated SAST / DAST scanning and container image signature verification
  • 7×24 on-call coverage and tiered alerting (Warning → Critical → Pager)

We make no claim to have achieved any of the above; this page will be updated as each is implemented.

Incident Response

  • Security issues are received at security@onemipham.com, with a target first response within 48 hours
  • Confirmed incidents produce a postmortem record after remediation

Contact

For security-related inquiries:

Security Team Email: security@onemipham.com

PGP Key: Available on request