Access control
Account and plan boundaries are enforced through authenticated services, database row-level security and automated security contracts rather than relying only on what the browser hides.
Operating controlTrust should be verifiable.
Watchdog is building its security, privacy and compliance program alongside the product. This page explains what is operating today, what we are actively validating, what source evidence is currently healthy or degraded, and what we do not claim yet.
No certification shortcut. Watchdog is not currently claiming SOC 2, ISO 27001, PCI DSS certification, OWASP certification, or site-wide WCAG 2.2 AA conformance. Those statements will appear here only when the supporting scope and evidence justify them.
Hosted payments
Subscription checkout is designed to redirect customers to Stripe-hosted Checkout. Watchdog uses billing identifiers and subscription state needed to operate the account, not full card numbers.
Hosted checkoutPrivacy by purpose
Optional account information is collected for stated product purposes. Watchdog documents data flows, connector risk, consumer rights, minimization and deletion/retention obligations.
Active programSecure development
Security contracts run with code changes to protect authorization boundaries, signed provider webhooks, server-authoritative pricing, CORS behavior and key deployment headers.
Automated evidenceAccessibility
WCAG 2.2 Level AA is the target. Automated and manual keyboard, focus, reflow, semantics and assistive-technology evidence is being built before any conformance claim is made.
Validation in progressSource-aware data
Watchdog separates endpoint health, materialized dataset coverage and configured reference metadata. Missing or degraded sources remain visible rather than being silently counted as available property evidence.
Evidence trackedChecking governed source evidence…Watchdog is reading the latest generated source-health report.
Frameworks we use to organize the work
OWASP ASVS 5.0.0Internal technical application-security verification baseline, targeting Level 2 requirements where applicable.
NIST CSF 2.0Cybersecurity governance and risk program organized around Govern, Identify, Protect, Detect, Respond and Recover.
WCAG 2.2 AAAccessibility target. No site-wide conformance claim is made while the full application is still being evaluated.
PCI DSSPayment scope is being kept narrow through provider-hosted checkout. The applicable merchant validation and external scanning requirements remain a future validation step.
New Jersey privacyConsumer rights, data minimization, security practices, connector governance and data-protection assessments are incorporated into the internal readiness program.
SOC 2 / ISO readinessControls and evidence are being accumulated now so a future independent audit does not require rebuilding the security program from scratch.
What customers can expect
Encryption in transitProduction web traffic uses HTTPS. TLS/HSTS configuration is tracked as auditable infrastructure evidence.
Payment separationCard entry is intended to happen on the payment provider's hosted checkout experience, not inside a Watchdog card form.
Consumer controlsWatchdog provides a privacy notice and maintains processes around access, correction, deletion, portability and opt-out rights where applicable.
Honest assurance languageInternal framework alignment is not presented as third-party certification. External validation dependencies and degraded data sources are labeled as such.