Security and data handling
Article9 holds grievance and representation data, some of it about individual members. Here is how that data is handled.
Where data lives
Site data is stored in a Postgres database tied to the region's Article9 account. Payment details are never stored here. Card and bank information is entered on Stripe's pages and held by Stripe; this site keeps only a subscription's status, plan, and billing period.
Access
The customer area requires a signed-in session. Sign-in is by single-use email link, so there are no passwords to phish or reuse. Sessions are carried in signed, httpOnly cookies. Raw IP addresses are never stored; the abuse-prevention limiter keeps only a salted hash.
Encryption
Traffic to and from the site runs over TLS. Data at rest is encrypted by the hosting and database providers.
Backups and retention
The database provider retains point-in-time backups. Demo and quote submissions are kept only as long as needed to respond, then removed.
Who can see member data
Within a region, member data is visible to that region's authorized representatives. Article9 does not sell data and does not use member data for any purpose beyond operating the service for that region.
Separation from the application
The Article9 application and this billing site are separate systems. This site does not read or write application data.