Account Protection
Session controls, MFA support, credential checks, and suspicious activity notifications help secure user accounts.
Security
Security by Design
Cofellow applies layered security controls across account access, platform operations, payments, and infrastructure to reduce risk and improve trust.
Effective date: February 28, 2026
Platform Controls
Access restrictions, validation, rate limiting, and monitored write flows reduce abuse and unauthorized actions.
Detection and Response
Security signals, logging, and response procedures are used to detect and address incidents quickly.
1. Security Program Overview
Our security approach includes preventative controls, detective monitoring, and operational response procedures designed for a multi-role transactional platform.
2. Authentication and Access
We support account verification workflows, optional multi-factor authentication controls, and role-based authorization boundaries to reduce unauthorized data and action access.
3. Data and Infrastructure Security
We use practical safeguards such as encrypted transit channels, restricted service access, and secure operational patterns for handling sensitive records.
Some security-critical operations involve third-party providers, including payment processors and identity verification vendors. We assess providers before use and limit shared data to what is necessary for each operation.
4. Abuse and Fraud Prevention
Automated and manual controls are used for abuse detection, including rate limiting, anti-bot checks, suspicious activity monitoring, and enforcement workflows.
5. Vulnerability Management
We assess and prioritize vulnerabilities based on risk, with remediation timelines influenced by severity and exploitability.
6. Incident Response
We maintain incident response procedures for containment, mitigation, investigation, and communication in line with applicable legal requirements.
7. Responsible Disclosure
If you believe you found a security issue, please contact us promptly with reproducible details so we can investigate and remediate.
Please do not perform destructive testing, data exfiltration, or denial-of-service activity.
8. Contact Security Team
Report security concerns to [email protected] and include relevant logs, timestamps, and affected flows.
Need immediate support?
For account access or security concerns, contact support quickly through our support channels.