Security & Compliance

1. Overview

Security is not a feature we added at the end — it is an architectural principle built into every layer of our products from day one. MapleHearth processes real financial transactions, stores sensitive business and marina resident data, and serves customers in regulated industries. That means we hold ourselves to the same security standards as financial institutions and healthcare organizations.

This page describes the technical and organizational controls we have implemented to protect your data across ArcAI and Marina Pro.

2. Cloud Infrastructure

All MapleHearth services are hosted on Microsoft Azure, one of the world’s leading enterprise cloud platforms. Azure data centers operate under ISO 27001, SOC 1/2/3, PCI DSS, and FedRAMP certifications, providing a robust compliance foundation that our applications build upon.

Infrastructure Security Controls

• Virtual Network Isolation: All application components run within dedicated Azure Virtual Networks (VNets) with network security groups (NSGs) controlling all inbound and outbound traffic
• Private Endpoints: Database and storage services are accessible only via private endpoints — they are not exposed to the public internet
• Web Application Firewall (WAF): Azure Application Gateway with WAF rules protects public-facing endpoints against OWASP Top 10 attack vectors
• DDoS Protection: Azure DDoS Protection Standard is enabled on all public-facing resources
• Managed Identity: Service-to-service authentication uses Azure Managed Identity — no static secrets or connection strings in application code
• Azure Key Vault: All encryption keys, certificates, and secrets are stored and managed in Azure Key Vault with FIPS 140-2 Level 3 hardware security modules (HSMs)

Availability & Reliability

• Services are deployed across multiple Azure availability zones to ensure resilience against single data center failures
• Automated health checks and auto-scaling ensure consistent performance under varying load
• Regular automated backups with point-in-time restore capability (Marina Pro database: daily full backups, continuous transaction log backups)
• Disaster recovery runbooks with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)

3. Payment Security

MapleHearth processes real money for marina operators — slip rentals, fuel, dock store purchases, charter bookings, and utility charges. We have taken a deliberate architectural decision to never handle raw payment card data directly.

Stripe-Powered Payments

All payment processing is handled by Stripe, Inc., which is certified to PCI DSS Level 1 — the highest level of security certification for payment processors. Stripe processes hundreds of billions of dollars annually for companies including Amazon, Google, Shopify, and Lyft.

When a customer enters payment information in Marina Pro, that data flows directly to Stripe’s secure infrastructure via Stripe Elements or Stripe Terminal. MapleHearth servers never receive, transmit, or store raw card numbers, CVVs, full bank account numbers, or unmasked payment credentials.

What We Store

For payment processing, MapleHearth stores only Stripe-generated tokens (e.g., pm_xxxxx, cus_xxxxx) which are useless outside of Stripe’s API. We store masked card details for display purposes only (last 4 digits, card brand, expiration month/year).

Stripe Connect (Sub-Rentals & Charter Payouts)

For dock sub-rental revenue splits and charter business payouts, we use Stripe Connect to facilitate transfers between parties. All fund flows are recorded, auditable, and governed by Stripe’s platform terms. Stripe handles all KYC (Know Your Customer) verification for connected accounts in accordance with financial regulations.

Stripe Terminal (POS)

Dockside card-present transactions use Stripe Terminal with EMV chip readers and end-to-end encryption. Card data is encrypted at the hardware level before leaving the reader and never passes through our application servers in plaintext.

4. Encryption

Data in Transit

All communications between users and MapleHearth services are encrypted using TLS 1.3. We enforce HTTPS across all endpoints and reject connections using TLS 1.0 or 1.1. Our SSL/TLS certificates are managed through Azure and automatically renewed before expiration.

Internal service-to-service communication within our infrastructure also uses TLS, ensuring no unencrypted data paths exist anywhere in our stack.

Data at Rest

All customer data stored in our databases, file storage, and backup systems is encrypted at rest using AES-256 encryption. Encryption keys are managed by Azure Key Vault with hardware-backed HSM storage. Key rotation is performed on a scheduled basis.

Document Storage (ArcAI)

Customer documents uploaded to ArcAI for indexing are stored in Azure Blob Storage with server-side encryption using customer-managed keys where requested. Documents are segregated per tenant and access-controlled via Azure RBAC and Shared Access Signature (SAS) tokens with limited lifetimes.

5. Access Control

Authentication

All user authentication for MapleHearth products is managed through Microsoft Entra ID (formerly Azure Active Directory), providing enterprise-grade identity management including:

• Multi-factor authentication (MFA) support and enforcement for privileged accounts
• Single Sign-On (SSO) integration with corporate identity providers via SAML 2.0 and OpenID Connect
• Conditional access policies that evaluate device compliance, location, and risk level before granting access
• Brute force protection, account lockout, and suspicious activity detection

Role-Based Access Control (RBAC)

Both ArcAI and Marina Pro implement granular role-based access controls. Users are assigned roles with least-privilege permissions — they see and can do only what their role requires. Roles are configurable by marina administrators and ArcAI tenant administrators.

Administrative Access

MapleHearth engineering staff access to production infrastructure is restricted to named individuals, requires MFA on every session, and is fully logged. We follow a break-glass procedure for emergency access, with all such access reviewed post-incident. No developer has standing access to production customer data — access is request-based and time-limited.

API Security

All API endpoints use short-lived JWT (JSON Web Tokens) for authentication with cryptographic signature verification. Tokens are issued by Microsoft Entra ID and validated on every request. Refresh tokens are rotated on use and invalidated on sign-out.

6. Multi-Tenant Architecture

MapleHearth serves multiple customers (tenants) from a shared infrastructure, and we take tenant data isolation extremely seriously. Our architecture ensures that Customer A cannot access Customer B’s data, even through bugs or misconfigurations.

How We Achieve Isolation

• Tenant-scoped query filters: Every database query includes a mandatory tenant identifier filter enforced at the data access layer. It is architecturally impossible to retrieve records without a valid tenant scope.
• Row-Level Security (RLS): Our database schemas employ row-level security policies as an additional defense-in-depth measure at the database engine level.
• Tenant-keyed storage containers: Files and documents are stored in tenant-specific containers/folders with separate access credentials per tenant.
• Separate AI index namespaces: ArcAI vector search indexes are logically separated per tenant. A tenant’s documents are only searchable from within their own tenant context.

We conduct regular automated testing to verify that cross-tenant data access is not possible and review our isolation controls as part of our security assessment program.

7. Audit Logging & Monitoring

Immutable Audit Trail

Every significant action in our systems generates an audit log entry that includes: timestamp (UTC), user identity, IP address, action type, affected resource identifier, before/after state, and outcome. Audit logs are immutable — once written they cannot be modified or deleted by any user, including administrators. Logs are retained for a minimum of 2 years.

What We Log

• All user authentication events (login, logout, failed attempts, MFA challenges)
• All data read/write/delete operations on sensitive records
• All configuration and permission changes
• All payment and financial transactions
• All administrative actions (role changes, tenant configuration, user management)
• All API calls with request metadata
• All document uploads and access events in ArcAI

Real-Time Monitoring & Alerting

We use Microsoft Azure Monitor and Application Insights for continuous monitoring of system health, performance, and security events. Automated alerts notify our on-call engineering team of anomalous activity, security events, and performance degradation within minutes. We maintain defined SLAs for alert response and incident escalation.

8. Compliance & Certifications

PCI DSS Level 1

MapleHearth achieves PCI DSS Level 1 compliance through our partnership with Stripe. By delegating all card data handling to Stripe’s PCI-certified infrastructure and never touching raw card data ourselves, we inherit Stripe’s Level 1 certification. This is the same model used by major technology platforms globally and provides the highest available standard of payment security.

SOC 2

Our operational controls are designed in alignment with SOC 2 Type II criteria, covering the Trust Service Criteria of Security, Availability, and Confidentiality. We are working toward formal SOC 2 Type II certification. Enterprise customers requiring the full report may contact us to discuss our current compliance posture.

GDPR & CCPA

We process personal data in accordance with the General Data Protection Regulation (GDPR) for EU/EEA data subjects and the California Consumer Privacy Act (CCPA) for California residents. See our Privacy Policy for details on data subject rights and our processing activities.

Microsoft Azure Compliance

Our Azure infrastructure operates under Microsoft’s comprehensive compliance portfolio, which includes ISO 27001, ISO 27018, SOC 1/2/3, CSA STAR, FedRAMP, and over 90 additional certifications. A full list is available at Microsoft’s compliance documentation.

9. Vulnerability Management

Dependency Scanning

We continuously scan all application dependencies for known vulnerabilities using automated tools integrated into our CI/CD pipeline. Critical vulnerabilities trigger immediate alerts and are patched within 24 hours; high-severity vulnerabilities are patched within 7 days.

Static & Dynamic Analysis

All code changes undergo static application security testing (SAST) as part of our code review process. Dynamic application security testing (DAST) is performed on staging environments prior to major releases.

Penetration Testing

We conduct third-party penetration tests on our production environment on at least an annual basis, and after significant architectural changes. Findings are remediated according to severity with tracking through to verified closure.

Patch Management

Operating system and infrastructure patches are applied on a regular schedule. Critical security patches are applied within 24 hours of availability. Azure-managed services (databases, storage, etc.) receive patches automatically through Azure’s managed update processes.

10. Incident Response

We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. Key elements of our response posture:

Detection & Response Times

• Detection: Automated monitoring alerts the on-call team within minutes of anomaly detection
• Initial Response: On-call engineers acknowledge and begin investigation within 30 minutes
• Containment: Affected systems can be isolated within minutes using automated runbooks
• Customer Notification: Customers affected by a confirmed breach are notified within 72 hours in accordance with GDPR requirements

Communication

In the event of a security incident affecting customer data, we will notify affected customers via email with: a description of what happened, what data was affected, what steps we are taking, and what customers should do. We commit to transparent and timely communication throughout an incident.

Post-Incident Review

Every significant security incident triggers a blameless post-mortem review to identify root cause, contributing factors, and systemic improvements. Action items are tracked to completion and incorporated into our security program.

11. Report a Vulnerability

We take security reports seriously and appreciate the security research community’s efforts to help us maintain a secure product. If you believe you have discovered a security vulnerability in any MapleHearth product or infrastructure, please disclose it to us responsibly.

Responsible Disclosure Guidelines

• Provide sufficient detail to reproduce the vulnerability (steps, screenshots, proof-of-concept)
• Do not access, modify, or delete customer data during your research
• Do not perform denial-of-service attacks or actions that could impact service availability
• Do not socially engineer our staff or customers
• Allow us reasonable time to investigate and remediate before public disclosure

Scope

In-scope: maplehearth.ai, arcai.maplehearth.ai, marinapro.maplehearth.ai, and any subdomain or API endpoint belonging to MapleHearth’s production services. Out-of-scope: third-party services and infrastructure we do not control (Azure, Stripe, etc. — report those directly to the respective vendor).

Safe Harbor

We will not pursue legal action against researchers who comply with this responsible disclosure policy, act in good faith, and do not access or exfiltrate customer data. We consider security research conducted in accordance with this policy to constitute authorized activity.