Security policy

The Provider adopts reasonable technical and organisational measures to ensure a level of security suited to the risk, in accordance with applicable law, including the Florida Information Protection Act, taking into account the particularly personal nature of the information Users entrust to the Service. This Policy describes those measures and is reviewed periodically.

For security reasons and to protect its trade secrets, the Provider does not publish technical details of its infrastructure or of how these measures are implemented.

• In transit. All communications between the User’s device and the Platform are encrypted using TLS, and the browser is required to always use encrypted connections.
• At rest. Stored information, including profile photos, is encrypted using the AES-256 standard.
• Credentials. User passwords and shared Reading passwords are stored only using salted cryptographic hash algorithms.
• Gift cards. Gift card security codes are stored encrypted.

• Password policy with a minimum length of eight (8) characters.
• Sign in with Google as an alternative to a password.
• Email address verification at registration.
• Sign-in verification (optional) using a six (6) digit code sent by email, valid for ten (10) minutes and with a limit on attempts.
• Sign-in alerts by email for every sign-in, indicating the device, IP address and approximate location.
• Sign-in history available to the User in Settings, including failed attempts.
• Expiring sessions of thirty (30) days, stored in protected cookies sent only over encrypted connections.

• Access to Users’ data is limited to authorised personnel who need it to provide support, ensure security or comply with legal obligations, in accordance with the principle of least privilege and under a duty of confidentiality.
• The administration panel is separate from User access and requires two-step verification.
• Sign-ins to the panel are logged and administrative sessions can be revoked immediately.
• Particularly sensitive operations, such as exporting a User’s data, require re-authentication.

• Browser security policies that restrict the execution of unauthorised code and the embedding of the Platform in third-party sites.
• Server-side input validation and protection against injection attacks.
• Rate limiting on sign-in, verification codes and sensitive operations, against automated and brute-force attacks.
• Atomic operations for charging and reinstating Runes, guaranteeing the integrity of the balance.

Payments are made on Stripe’s checkout page, a provider certified to PCI DSS Level 1. Card data is transmitted directly to Stripe; the Provider only receives the transaction confirmation and an identifier, and the authenticity of each payment notification is verified by cryptographic signature.

Shared Readings are protected by a unique link and a password chosen by the User, stored as a hash, and expire after twenty-four (24) hours. They are not published on public profiles and are not accessible to search engines.

The Platform is hosted with leading cloud infrastructure providers that hold recognised industry certifications such as SOC 2 or ISO/IEC 27001. The Provider selects its providers based on the security guarantees they offer and enters into the corresponding data processing agreements with them.

Information benefits from backup and point-in-time recovery mechanisms, ensuring its availability and resilience.

To generate Readings, the Service must process the content of consultations and disclose it to artificial intelligence providers as set out in the Privacy policy. For this reason, the Service does not apply end-to-end encryption, which would prevent it from working. Information is protected by the layers of encryption and access control described in this Policy.

No system connected to the internet is absolutely invulnerable. The Provider continuously reviews and strengthens its security measures in line with the state of the art.

In the event of a security incident, the Provider will contain, analyse and resolve it. If it affects personal data, the Provider will notify the affected Users and, where applicable, the competent authorities without undue delay and within the applicable legal deadlines, which under the Florida Information Protection Act is no later than thirty (30) days, together with recommended measures.

• Use a strong, unique password for Sonia Oracle, or sign in with Google.
• Turn on sign-in verification in Settings.
• Review the sign-in history periodically.
• Check that you are on an official domain (soniaoracle.com) before entering your credentials.
• Be wary of any message asking for your password: the Provider will never ask for it.
• Sign out when using shared devices.

Anyone who discovers a vulnerability may report it to legal@soniaoracle.com, describing the steps to reproduce it. The Provider asks that the following guidelines be observed:

• Do not access, modify or delete third-party data beyond what is strictly necessary to demonstrate the vulnerability.
• Do not carry out tests that degrade the Service, such as denial-of-service attacks, mass messaging or social engineering.
• Allow a reasonable period for remediation before any public disclosure.

The Provider will not take legal action against anyone who, acting in good faith, follows these guidelines, and will inform them when the reported vulnerability has been resolved.