Security

Last updated: September 26, 2026

Core controls

• Cloudflare TLS, CDN, WAF-compatible controls, Turnstile-verified contact requests, and scoped runtime bindings.
• Secrets stored as Cloudflare secrets or local development variables, never in source control.
• Applicant documents use a private R2 bucket with public-development URLs and custom public domains disabled; the public upload step remains gated.
• The public contact form does not request banking credentials. When business owners link a bank account through Stripe Financial Connections, they sign in to their bank through Stripe's window: Stelo never sees the login typed into Stripe's window, and Stelo's app never logs in to a bank. Bank data received from Stripe is stored encrypted and kept out of analytics, AI tools, and logs.
• Token-protected administrative APIs, audit events, prepared D1 statements, file-size and signature checks, and quarantine status.
• PII excluded from commits, ordinary logs, screenshots, public AI tools, and model-ready datasets.

Responsible disclosure

Report a suspected vulnerability to security@updates.stelopartners.com with reproduction steps and affected URLs. Do not access, alter, download, or retain another person's data; disrupt service; use social engineering; or publicly disclose an unresolved issue. Stelo does not currently promise a bug-bounty payment.

Incidents

Suspected incidents are contained, investigated, documented, and evaluated for contractual and legal notice obligations. Security controls reduce risk but cannot guarantee absolute security.