Security

Effective date: 2026-08-18 · Version: 1.0.0 · Last reviewed: 2026-08-18

This page collects Expeal's security posture in one place: what protects this site, what protects the Expeal application, how long information is kept, what rights you have over it, and how to tell us when something is wrong. Each section links the policy that governs it — this page summarizes; the policies control.

1. This website

expeal.com is a static site with a deliberately small attack surface. It has no accounts, no forms, and no database. It sets no cookies, uses no browser storage, and makes no third-party requests — commitments recorded in the Privacy Policy and enforced by our build checks on every change.

All traffic is served over HTTPS with HTTP Strict Transport Security; requests over plain HTTP are redirected. Responses carry a Content Security Policy, frame-ancestors, content-type, and referrer-policy headers.

2. The Expeal application

The application at app.expeal.com handles the sensitive information you provide to prepare a case, and its protections are described in the Application Privacy Policy: HTTPS encryption of all traffic, a strictly enforced Content Security Policy, sign-in passcodes stored only as cryptographic digests, encryption of data at rest on our database platform, access controls limiting case data to authorized staff, and security review of changes before release.

3. Retention

This site retains nothing about you — it collects nothing. The application retains your account and case answers for as long as your account exists, so your case can be processed and resumed; server logs are kept for approximately one week. Published retention durations are being finalized in the Application Privacy Policy (its Section 7), and updates follow that policy's notice process.

4. Your data rights

You may request access to or deletion of your information at any time — the process and its limits are in the Application Privacy Policy (its Section 8). Privacy requests go to privacy@expeal.com.

5. Who processes data for us

The third-party providers that host or deliver Expeal services — and what each one handles — are listed on the subprocessors page. We do not use analytics, advertising, or data-broker services anywhere.

6. Certifications

Expeal holds no third-party security certification today — no SOC 2 report, no ISO 27001 certificate. We say so rather than imply otherwise; if that changes, this page and its change log will record it.

7. Reporting a vulnerability

Security research is welcome under our Vulnerability Disclosure Policy. Reports go to security@expeal.com; the same address and policy are published machine-readably at /.well-known/security.txt.