Security

All data in transit is encrypted with TLS 1.2 or higher, and that is a control we operate. Data at rest, uploaded documents, processed results and any stored value, is encrypted at the infrastructure layer by our cloud provider. Application-layer encryption for portal credentials is Phase 2, and applies to that storage rather than to uploaded documents or processed results.

Disputek does not hold retailer portal credentials at all. The current release is manual CSV upload: you export the deduction report from each portal and upload it, so there is no portal credential in our systems to protect, store, or rotate.

Portal automation is Phase 2 (see the roadmap below). The design we have committed to for it is:

• Encrypted before storage, with application-layer encryption, not only host-level
• Separated per retailer, per customer; no shared credential pools
• Never logged, never exposed in support workflows
• Gated on SOC 2 Type II before Enterprise-scale storage

Where OAuth 2.0 is available, it is preferred over username/password storage.

Each customer's data is logically isolated. Your documents, dispute packets, and analytics are never shared with or accessible by other customers. We do not share your data with retailers.

• Role-based access control (RBAC) for all internal systems
• Principle of least privilege; staff access is scoped and audited
• Single sign-on for Enterprise is on the roadmap and is not available today
• All access events are logged and reviewable

If we discover a security incident affecting your data, we will notify affected customers within 72 hours of confirmation, along with details of the scope and remediation steps.

Found a vulnerability? Email security@disputek.org. We acknowledge all legitimate reports within 48 hours and work with researchers to remediate.