Honest specifics about the controls we have in place, the boundaries we own, and the certifications we have not claimed. If we say we do something, we do it. If we are not yet certified for something, we say so.
GDK Digital uses a single universal login at gdkdigital.com/login.html. A
successful login issues a JSON Web Token signed with a shared platform secret. Each
product backend verifies the signature with the same secret. Specifically:
localStorage and presents the
access token as a Bearer credential on API calls.
The trust bridge between products is the signed JWT, not a shared database connection. Rotating the platform secret invalidates every token in the system, which we treat as a coordinated event.
Vault contents are encrypted client-side before they touch the network. The server stores encrypted blobs and never sees plaintext. Decryption happens only on devices you control.
Tenant-isolated data model with row-level security policies at the database layer. Each tenant's data is unreachable from other tenants' queries.
QR redirect payloads with sensitive content use client-side AES-GCM encryption with the decryption key carried in the URL fragment (never sent to the server).
If you believe you have found a security vulnerability in any GDK Digital product, please email security@gdkdigital.com.
We do not pursue legal action against good-faith security researchers who follow responsible disclosure: do not access data that does not belong to you, do not impact service availability, and give us reasonable time to fix the issue before public disclosure.
Transport security uses TLS 1.2 or higher across all public surfaces. Authentication uses signed JSON Web Tokens (JWT) with rotating secrets and short access-token lifetimes. Passwords are hashed with Argon2id where supported and bcrypt otherwise. Fortilis specifically uses zero-knowledge client-side encryption so the server never sees plaintext credentials.
No. We do not currently claim SOC 2 certification. We do not display badges or seals we have not earned. If formal certification is on our roadmap, we will update this page when it changes.
A single universal login at gdkdigital.com/login.html issues a JWT
signed with a shared platform secret. Each product backend verifies the signature
with the same secret. The trust bridge between products is the signed JWT, not a
shared database connection.
Email security@gdkdigital.com with a description of the issue, reproduction steps, and any proof-of-concept material. We acknowledge reports within two business days. We do not pursue legal action against good-faith researchers who follow responsible disclosure.
Platform identity data (users, organizations, subscriptions) is stored in a MySQL database hosted with Hostinger in the United States. Product data is stored per product, typically in Supabase PostgreSQL (also U.S.-hosted) or in a per-product MySQL database. Fortilis vault contents are encrypted client-side; the server stores only encrypted blobs.
No. Custom AI agents and Claude Skills we build for clients are scoped to that client's use case. We do not reuse client data, prompts, or knowledge bases across other client builds, and we do not feed customer data into general-purpose model training.
For general questions, use the contact form. For security disclosure, email security@gdkdigital.com.
Last updated: 2026-05-28