Security controls
Current controls include TLS in transit, restricted private storage, hardened session cookies, content-security policies, network firewalling, Fail2ban, private binding for internal APIs, patch and vulnerability management, backups, audit logging, role-based administrative access and incident-response procedures. Controls are reviewed and improved as systems and risks change.
Payment security
Harborview's design objective is to keep full payment-card numbers and card security codes out of Harborview application databases by using authorised payment processors. Payment environments remain subject to applicable PCI DSS scope and validation.
Responsible disclosure
If you believe you found a security issue in a Harborview-operated system, send enough detail to reproduce the issue to operations@harborviewopps.com. Do not access, change, download or retain personal information beyond what is necessary to demonstrate the issue, and do not disrupt production services.
Compliance and assurance status
Harborview is building its privacy and security controls around Bermuda PIPA, applicable GDPR/UK GDPR obligations, applicable U.S. privacy requirements, PCI DSS for payment scope, and enterprise security frameworks. Harborview does not represent that an external certification, audit attestation or regulator approval exists unless specifically stated in writing.