Security policy

Data encryption

All communications between your browser and our servers are encrypted with TLS 1.3. Passwords are hashed with Argon2id. Data at rest is encrypted on our servers.

Data isolation

Each account is isolated through multi-tenant architecture with Row-Level Security (RLS) on PostgreSQL. Your recipes and ingredients are only accessible by you.

Authentication

• JWT tokens with automatic rotation (access token 15 min, refresh token 7 days)
• Brute force protection with rate limiting (5 attempts per minute)
• Strict password validation (minimum 8 characters)

GDPR compliance

Mix Control complies with the General Data Protection Regulation (GDPR). Your rights:

• Right of access: export your data at any time from Settings
• Right to rectification: edit your profile and data freely
• Right to erasure: delete your account with a 48-hour grace period
• Right to portability: export in JSON or CSV of all your data

Backups

Data is backed up daily with 30-day retention. Servers are hosted in France (Paris) at Hostinger.

EU Cyber Resilience Act Compliance

Mix Control is committed to compliance with the EU Cyber Resilience Act (CRA). We implement the following measures:

• Software Bill of Materials (SBOM): CycloneDX format generated for every release, covering all Rust and NPM dependencies
• Vulnerability disclosure: security issues are reported within 24 hours of discovery, with fix timeline communicated publicly
• Security updates: automated dependency auditing with cargo-audit and npm audit, critical CVEs trigger immediate patches
• AI agent gateway: MCP endpoints are protected by application-level filtering against prompt injection and data extraction attacks