sovel.pro Evidence-aware platform
Platform Governance & Legal

Security & Responsible Disclosure

Effective Date: September 16, 2026 • Last Updated: September 21, 2026 • Platform Version: 1.0.0 • Status: Active Official Policy

Platform security architecture, delivery package integrity verification, and our responsible vulnerability disclosure guidelines.

1. Security Architecture

SOVEL implements rigorous, verified security controls across all digital assets and infrastructure:

  • Protected Digital Fulfillment: Product archives are distributed through WooCommerce protected digital download permissions. Direct file paths are stored in isolated directories outside public web root access and protected by server-level deny rules. Access is validated per-order through authorized session tokens.
  • Package Integrity Verification: Where a product package ships a published checksum manifest, release archives include cryptographically verifiable SHA-256 checksums, enabling users to verify byte-level file integrity prior to extraction. Checksum manifests are provided per product, not uniformly across every release.
  • Application Security Headers: The platform theme emits standard HTTP security headers on all public requests: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy: strict-origin-when-cross-origin.
  • Deployment-Layer Controls: Transport-layer security (TLS 1.3 / HTTPS), Strict-Transport-Security (HSTS), and edge web application firewall (WAF) rules are deployment-layer infrastructure controls configured at the staging and production hosting layer.

2. Responsible Disclosure Policy

We take the security of our platform, customer data, and digital deliverables seriously. If you discover a potential vulnerability in our website, infrastructure, or product delivery systems, we ask you to report it to us immediately and confidentially.

3. Reporting a Vulnerability

Please send detailed vulnerability reports to security@sovel.pro (or via our Contact form under the Security Report category) with reproduction steps and potential impact. Please do not include credentials, secrets, or sensitive customer data in your report.

4. Safe Harbor Commitment

If you conduct vulnerability research in good faith in accordance with this policy, SOVEL commits to acknowledging receipt targeted within 48 business hours, working with you to validate and remediate the issue within a reasonable timeframe, and not taking legal action against authorized research.