01Scope
This policy describes the technical and organizational measures Ethos Bio LLC uses to protect information collected through ethosbioresearch.com, including customer account data, order records, and payment authorization data. It applies to our website, our serverless application infrastructure, and the third-party processors we rely on.
We never store card numbers. We never store bank login credentials. Bank account and routing numbers are used only to authorize a single transaction and are not persisted — our order records keep only the last four digits for reconciliation. All traffic is encrypted in transit, and payment processing is handled by regulated third parties.
02Infrastructure
Our storefront is a static site served over a global CDN with automatic TLS. Application logic runs as isolated serverless functions rather than a persistent server, which materially reduces attack surface: there is no admin panel exposed to the public internet, no CMS login, no database server listening on a public port, and no long-lived host to compromise.
- TLS 1.2+ enforced on all connections, with HTTPS redirection and HSTS.
- Serverless execution — functions are short-lived, isolated, and independently scoped.
- Encrypted storage at rest for order records.
- No WordPress, no public CMS, no shared hosting — the most commonly exploited e-commerce attack vectors do not exist in our stack.
- DDoS protection and edge filtering provided at the CDN layer.
03Payment data
Ethos Bio does not process, transmit, or store credit card numbers. Payments are made by bank debit (ACH/eDebit) through Green.money, a regulated payment processor operating under NACHA rules.
When a customer pays by bank debit:
- Bank account and routing numbers are transmitted over TLS directly to the processor for a single authorization.
- Those numbers are never written to our database, never written to logs, and never retained after the request completes.
- Only the last four digits of the account number and the institution name are stored, solely for customer support and order reconciliation.
- Every debit requires explicit customer authorization, captured and timestamped at checkout.
- Real-time account verification is performed before an order is accepted; failed verifications are declined and cancelled rather than held.
04Bank account verification (Plaid)
Where customers choose to connect a bank account rather than enter details manually, we use Plaid for account verification.
- Bank login credentials are entered inside Plaid's interface and are never seen, transmitted, or stored by Ethos Bio.
- Our browser code receives only a short-lived public token. Account details are resolved server-side, so account numbers never pass through the customer's browser session in our application.
- We request Auth only — the minimum scope required to verify an account for a one-time payment. We do not use Plaid for recurring billing, lending decisions, balance monitoring, or ongoing account access.
- Access tokens are used for the single verification call and are not retained for ongoing access.
05Secrets and credentials
All API keys, processor credentials, and integration secrets are stored as encrypted environment variables in our hosting platform, injected only into server-side functions at runtime. Secrets are never committed to source control, never exposed in client-side JavaScript, and never returned in API responses. Our deployment pipeline runs automated secret scanning on every build and blocks releases that would publish credentials.
Client-side identifiers that are safe by design — such as analytics measurement IDs and publishable tracking keys — are the only keys present in page source.
06Access control
- Administrative access is limited to the company owner and, where required, a named contractor.
- Multi-factor authentication is enabled on hosting, source control, payment, email, and fulfillment accounts.
- Third-party processors receive the minimum data required to perform their function.
- Machine-to-machine endpoints (fulfillment integration) are authenticated and rejected without valid credentials.
07Application security
- Server-side repricing. Every order total is recalculated on the server from an authoritative price table. Client-submitted prices are never trusted, and an order whose displayed total does not match the server total is blocked rather than charged.
- Input validation on all submitted fields, with length limits and format enforcement.
- Output encoding to prevent injection in generated documents and responses.
- Signature verification on inbound processor webhooks, with replay protection, so payment status cannot be spoofed.
- Least-privilege logging. Sensitive fields are excluded from application logs by design.
08Data retention
Order, compliance, and certificate-of-analysis records are retained for seven (7) years as required by U.S. tax and research-supply compliance obligations. Payment authorization artifacts are retained only as required by our processor's recordkeeping rules. Bank account and routing numbers are not retained at all. Full detail is available in our Privacy Policy.
09Age and eligibility controls
Access to the storefront is gated to visitors 21 years or older, and every order requires an affirmative research-use-only certification, captured and timestamped with the order record. Products are supplied for laboratory research use only and are not sold for human or veterinary use.
10Incident response
If we become aware of a security incident affecting customer data, we will:
- Contain the incident and revoke or rotate any affected credentials immediately.
- Investigate scope and impact, preserving relevant logs.
- Notify affected customers and any required regulators or processors within the timeframes applicable law requires.
- Remediate the root cause and document the corrective action taken.
No system is perfectly secure. Our commitment is to minimize what we hold, encrypt what we transmit, and disclose promptly and honestly if something goes wrong.
11Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability in our site or infrastructure, email info@ethosbioresearch.com with the subject line "Security Disclosure." Please include steps to reproduce and allow us reasonable time to remediate before public disclosure. We will not pursue action against researchers who report in good faith, avoid privacy violations and service disruption, and do not access or modify data beyond what is necessary to demonstrate the issue.
12Updates
We review this policy as our infrastructure changes and at least annually. Revisions are posted at ethosbioresearch.com/security with an updated effective date.
13Contact
Security questions and disclosures: info@ethosbioresearch.com. Ethos Bio, LLC · Scottsdale, Arizona · United States.