Security

1. Access model

Megladon workspace access is invite-only. Public forms do not create a workspace account, and private workspace roles are scoped to the relationship and operational need.

Administrative access is limited to approved operators and should be protected with strong authentication and least-privilege controls.

2. Transmission and storage

Public website traffic is served over HTTPS. Authentication sessions, workspace records, and operational systems use managed infrastructure with access controls appropriate to the sensitivity of the workflow.

Confidential transaction documents should only be exchanged through the private route requested by Megladon, not through public forms.

3. Operational controls

Megladon uses role-scoped workflow surfaces, review states, controlled invitations, and internal records to reduce unnecessary disclosure.

The operating principle is simple: no authority, no motion; no disclosure permission, no circulation.

4. Service providers

Megladon may rely on managed providers for hosting, authentication, email delivery, logs, analytics, and operational tooling. Provider access is limited to what is needed for the service they perform.

5. Incident handling

If Megladon identifies a security or personal-data incident, we will investigate, contain, and notify affected parties or authorities where required by applicable law.

6. Vulnerability reports

Security concerns can be sent to [email protected]. Please avoid public disclosure until Megladon has had a reasonable opportunity to investigate and respond.