Data Security & Responsible Disclosure
Homeward · NeotericX Incorporated
Version 1 · 2026-10-30 00:00:00

Current safeguards, sensible limits, and a direct security-reporting route.

## Homeward and NeotericX

Homeward is owned and operated by NeotericX Incorporated. This Homeward policy is effective October 30, 2026. Mandatory legal rights and applicable separate agreements take precedence.

## Implemented safeguards

Homeward uses HTTPS, server-side validation, bound database parameters, origin checks on writes, and session security tokens for authenticated writes. Passwords use salted scrypt hashes. Sessions use hashed random tokens, secure HTTP-only cookies, and a 12-hour expiry. Account data is scoped to the authenticated user; management endpoints require an administrator role.

Authentication and public form endpoints apply rate limits. Administrators can suspend ordinary users, revoke sessions, and review audit events. Recovery codes are stored as hashes and are single use. A password reset revokes sessions. These controls reduce risks without eliminating them.

## Limits and responsibilities

There is no claim of ISO 27001 or SOC 2 certification, a completed independent audit, universal regulatory compliance, or an availability or recovery-time guarantee. Multi-factor authentication, ordinary email verification, and email password-reset delivery are not currently configured. Social sign-in requires provider setup. Cloudflare hosting does not itself establish that a particular paid WAF rule set has been configured.

Do not store highly sensitive or regulated information here. Ask about a separate written agreement before using Homeward for a service with specialized security, data processing, retention, or audit requirements. We will investigate suspected exposure and make notifications where required by applicable law.

## Report a concern

Email info@neotericx.info with “Homeward security report”, the affected URL and minimal, redacted reproduction steps. Do not send credentials or other people’s records. Stop if you encounter someone else’s data. The Responsible Disclosure Policy explains testing boundaries. No bounty or response deadline is promised.