Security overview · Updated 28 August 2026
Protection model
- Request only the permissions and content needed for the feature a person chooses.
- Protect records stored by the iPhone app with platform security controls and clear export boundaries.
- Use authenticated, encrypted connections for network features and protect sensitive service credentials.
- Validate request shape and size, limit abuse, separate environments, and keep secrets out of source code.
- Redact credentials and private case content from operational logs.
- Treat account deletion, retention, backups, and recovery as security controls—not administrative afterthoughts.
Data boundaries
A feature should not receive unrelated device content simply because another permission was granted. Screenshot checks validate source type, encoded size, dimensions, and decoded pixel count, then rasterize the selected image into a bounded JPEG or PNG before upload. Analysis responses are size-bounded and contract-validated. Connected services are reviewed for narrow access, encryption, retention, notification privacy, and deletion. Public disclosures must match the network behavior of the released build.
Assurance process
- Threat-model identity, Trusted Circle, backup, recovery, and payment-adjacent flows.
- Run dependency, secret, static-analysis, migration, retention, and account-deletion checks.
- Review production secrets, backup and restore, monitoring, alerting, and incident response.
- Reconcile the Apple privacy manifest, App Store privacy answers, website policies, vendors, and actual network behavior.
- Use independent mobile and API security testing as part of the release assurance process.
Responsible disclosure
Please do not post exploit details or personal data publicly. Start from the PauseSure Support page for current safe-routing instructions, and use only a private reporting route verified on pausesure.com. Include the affected surface, reproduction steps, and impact without attaching credentials, access tokens, private keys, or personal case evidence.
Safety boundary
PauseSure is decision support and cannot guarantee that a person, message, link, or transaction is safe. If money or credentials may be at risk, stop contact and reach the relevant organization through an official channel you locate independently.