Security Standards
Last Updated: July 19, 2026
1. Authentication & Access Control
Thula delegates user authentication and credential security to Auth0, a leading enterprise-grade identity platform. Your passwords are never stored on our servers. All API endpoints require verified JSON Web Tokens (JWTs) using secure signature algorithms to prevent unauthorized access.
2. Data Transmission & Encryption
All data in transit is protected using industry-standard Transport Layer Security (TLS 1.3) and HTTPS protocols. Data at rest is encrypted using AES-256 standard encryption, ensuring that database records, user history, and reputation ledgers are protected against unauthorized physical and digital exposure.
3. Double-Blind & Consensus Integrity
To prevent retaliatory ratings and fraud, review contents and ratings are kept hidden from both parties until both have submitted their reviews (double-blind system). Our reputation ledger runs on a weighted consensus model, weighting reviews by the reviewer's own verified trust level, mitigating bot manipulation and sybil attacks.
4. Infrastructure & DDoS Mitigation
Our web platform is hosted on secure, containerized environments behind managed Cloudflare CDN services. We employ active denial-of-service (DDoS) protection, automated web application firewalls (WAF), and rate-limiting rules to ensure platform availability and reliability under load.
5. Vulnerability Disclosures
We encourage responsible disclosure of security vulnerabilities. Security researchers can contact us directly via our public security configuration file at /security.txt or by emailing [email protected].