Security posture for ACC API, ledger and verification data.

Security posture

ACC treats security as part of trust infrastructure. The current architecture separates public website, API/Core logic, certificate records, object storage, email and administrative controls.

Current infrastructure

• Vercel hosts the public web application.
• Cloudflare Workers provide ACC Core API logic.
• Cloudflare D1 and R2 support certificate data and proof objects.
• home.pl supports domain, DNS and email infrastructure.
• SMTP is used for verification email flows.
• SHA-256 hashes, ledger events and batch roots support integrity evidence.

Controlled-access boundary

The current release is not yet a full enterprise SLA environment. Some controls, including partner API keys, webhooks, advanced abuse controls and administrative workflows, may be limited or manually supervised.

API protection

Public endpoints use validation and basic abuse controls. Partner and operational endpoints may require administrative or partner keys. ACC may rate-limit, block or investigate traffic that threatens service integrity.

Ledger integrity

ACC ledger events are designed to preserve payload hashes, previous event hashes, certificate IDs, event types, timestamps, batch roots and anchor status so certificate history can be audited.

Responsible disclosure

Security reports should be sent to info@artclearancecertification.org with the subject 'ACC Security'. Reports should include a description, reproduction steps, impact assessment and contact details.

Rules for security research

• Do not access, copy or disclose data belonging to other users.
• Do not perform destructive testing or denial-of-service attacks.
• Do not bypass rate limits in a way that causes harm.
• Do not publish vulnerability details before ACC has had a reasonable opportunity to respond.

Incident response

If ACC identifies a security incident, it will assess scope, protect the system, preserve evidence and notify affected parties or authorities where legally required.