Security Policy

How we protect ProfileTo systems and user data. Last updated: July 2026

← Back to ProfileTo

This Security Policy describes security practices used by Innocode Ventures (operating as ProfileTo) for the ProfileTo website, dashboard, and related services at profileto.com. It is intended for users, reviewers, and partners (including Zoom App Marketplace review) who need a clear summary of how we protect accounts and connected service data.

For privacy rights and data-use details, see our Privacy Policy. For retention periods, see our Data Retention and Protection Policy.

1. Scope

This policy covers:

  • The ProfileTo web application and APIs
  • Account authentication and session handling
  • Databases that store profile, booking, and integration data
  • Optional third-party OAuth integrations (including Google Calendar / Google Meet and Zoom)
  • Hosting and supporting infrastructure used to run ProfileTo

2. Security principles

  • Collect and request only the permissions and data needed for the feature in use
  • Protect secrets and OAuth tokens with encryption and access controls
  • Transmit data over HTTPS in production
  • Limit production access to authorized personnel and systems
  • Design integrations so users can disconnect third-party apps and revoke access

3. Application and infrastructure controls

  • Hosting: ProfileTo is deployed on managed cloud infrastructure (including Vercel for the application layer).
  • Transport security: Production traffic is served over HTTPS/TLS.
  • Application stack: Next.js / TypeScript web application with server-side API routes for authenticated actions.
  • Databases: Regional Turso (SQLite) databases accessed through application credentials; booking and integration data are stored in these databases.
  • Authentication: Account access is protected by ProfileTo authentication (including optional Google sign-in). Authenticated dashboard routes require a valid session.
  • Secrets management: API keys, OAuth client secrets, and similar credentials are stored as environment secrets in the hosting platform, not in public source files.
  • Dependency and platform updates: We use maintained frameworks and hosting platforms and apply updates as part of normal operations.

4. OAuth and third-party integrations

When a user connects Google Calendar / Google Meet or Zoom, ProfileTo uses OAuth 2.0. Access and refresh tokens are stored in encrypted form in our database. Tokens are used only to provide the connected feature (for example, calendar sync or Zoom meeting create / update / delete for bookings).

Zoom-specific scopes are limited to meeting create, update, and delete, plus reading the authorizing Zoom user. Users can disconnect Zoom from Dashboard → Appointments → Connections, which removes stored Zoom tokens from ProfileTo.

5. Data classification (summary)

  • Credentials / tokens: Encrypted at rest; treated as highly sensitive
  • Account and profile data: Protected by authentication and access controls
  • Booking metadata: Stored to operate scheduling (for example meeting time, guest contact details, meeting link / Zoom meeting ID)
  • Public profile content: Intentionally public when published by the profile owner

6. Access control and human access

Production systems and databases are restricted to authorized personnel. ProfileTo staff do not browse user Google Calendar contents, Zoom meetings, or OAuth token plaintext as a routine practice. Access to production data is limited to support requests, security investigations, legal obligations, or service maintenance, and is limited to the minimum needed for that purpose.

7. Vulnerability and change handling

  • Security-relevant issues reported to [email protected] or [email protected] are reviewed and prioritized
  • Application changes are deployed through our normal release process on the hosting platform
  • We do not claim continuous formal SAST/DAST coverage or third-party penetration testing in this policy unless separately evidenced by a current report

8. Incident response (summary)

If we become aware of a security incident affecting ProfileTo user data, we aim to:

  1. Contain and investigate the issue
  2. Assess impact and affected accounts or integrations
  3. Remediate (for example revoke compromised credentials, patch systems)
  4. Notify affected users and regulators when required by applicable law
  5. Document lessons learned and improve controls where appropriate

9. User responsibilities

  • Protect your ProfileTo account credentials and device access
  • Connect only Google or Zoom accounts you are authorized to use
  • Disconnect integrations you no longer need
  • Report suspected unauthorized access promptly

10. Contact

Security or privacy questions: [email protected] / [email protected]. Operating company: Innocode Ventures (operating as ProfileTo).