Security & operational safeguards

Production access controls

Dynamic public traffic is routed through the Panther Hook Cloudflare edge. The Cloud Run application rejects untrusted direct-origin API and public form requests, while internal task endpoints use Google-authenticated service identities.

Authentication and browser security

Browser authentication uses revocable server-side sessions with Secure production cookies and CSRF protection for state-changing requests. Google and GitHub OAuth are available as sign-in methods. Authentication and security email from auth@pantherhook.com, along with customer owner notifications and autoresponders from notifications@pantherhook.com, is delivered through AWS SES. Inbound mail to support@pantherhook.com continues through Cloudflare Email Routing. Resend remains available only as a manual operational rollback option and is not the active production email provider.

Database and secrets

Application runtime uses a separate least-privilege PostgreSQL role from the migration owner role. Runtime connections use the pooled Neon endpoint; migrations use a direct endpoint with full TLS certificate and hostname verification.

Production application secrets are injected from Google Secret Manager. Selected customer credentials, including integration and anti-spam secrets, are encrypted by the application before database storage and are not returned through normal APIs.

Bounded abuse and delivery

Public production ingestion is protected first by Cloudflare's edge and an abuse-oriented Worker rate limiter, with a separate bounded origin-side emergency limiter behind it. These abuse controls are intentionally separate from authoritative commercial plan quota accounting. Edge rate-limit counters are not represented as an exact globally synchronized billing or usage invariant. Authentication email, webhook delivery, native integrations, queues, retries, and Cloud Run scaling also use explicit limits and operational kill switches. Webhook deliveries use signed payloads, bounded retry behavior, reconciliation, and destination safety checks.

Files, Performance, and retention

Production file uploads use a private Cloudflare R2 bucket restricted to the EU jurisdiction, bounded Worker upload grants, plan storage quotas, and short-lived authenticated downloads. Panther Hook does not claim automatic malware scanning.

Persistent production Performance click tracking is active for entitled Pro and Agency workspaces, with bounded click-retention cleanup. Starter retains lead-level attribution without persistent click capture.

Automatic submission-retention cleanup is active. Each workspace keeps its configured retention period within the plan maximum; expired submissions are removed and their attached R2 objects are deleted by the bounded cleanup lifecycle. Self-service workspace and account deletion remain available separately.

Current limits

Panther Hook does not currently claim SOC 2, ISO 27001, HIPAA certification, a guaranteed uptime SLA, geographic redundancy, or a disaster-recovery SLA. Database recovery is limited to the capabilities and configured history of the current database provider plan.

Security contact

Security or abuse concerns can be sent to support@pantherhook.com.