Security

01 · Transport

TLS and HSTS

All traffic to ridgeratings.com is served over TLS terminated at the Cloudflare edge. The origin additionally sends Strict-Transport-Security: max-age=31536000; includeSubDomains on every response, so browsers refuse plain HTTP for a year after the first visit. Every response also carries X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy (no geolocation, camera or microphone) and X-Frame-Options: SAMEORIGIN, except the /embed widgets, which are designed to be framed.

02 · Origin

The origin is not publicly addressable

The application server listens on localhost only and is reached exclusively through an outbound Cloudflare Tunnel (cloudflared, QUIC). No inbound port is open to the internet, so the origin has no public IP address to scan or attack directly. A staging mirror serves the same code for acceptance testing and is marked noindex.

03 · Credentials

API keys and sign-in

• API keys are hashed at rest. Ridge stores only the SHA-256 digest of each Enterprise and Ridge Pro key; a presented key is hashed and compared, and the plain key is never written to disk after issue.
• Sign-in is by magic link, not password. A sign-in link works once and expires after 15 minutes; the token behind it is stored hashed, so a leaked token file cannot be replayed. The seat cookie (lk) is HttpOnly, SameSite=Lax and Secure.
• Rate limits. The Enterprise API is limited to 120 requests per minute per key (the public evaluation key to 20 per minute); the public enquiry endpoint is rate-limited per visitor IP, using the address Cloudflare passes through rather than the tunnel's.
• Licensed data never leaves through the browser. Key-gated responses are sent Cache-Control: no-store; only public datasets are edge- or browser-cacheable.

04 · Payments

Stripe hosted checkout

Card payments run on Stripe's hosted Checkout page. No card number, expiry or security code ever touches a Ridge server; Ridge receives only the checkout session outcome. Stripe webhooks are accepted only with a valid Stripe-Signature (HMAC-SHA256 over the timestamped payload, constant-time comparison, five-minute clock-skew cap). Whether checkout is open or by agreement is published on /status.

05 · Backups

Nightly, checksum-verified, offsite

The serving tree and its data are archived nightly. The archive's SHA-256 is computed at source and verified after every hop: first on a local copy, which always runs first so an offsite outage can never mean zero backup, then on the offsite copy over SSH, where the checksum of the bytes that landed is compared with the bytes sent. Fourteen nightly archives are retained. Offsite failures are counted, and three consecutive failures escalate to an urgent alert rather than a log line.

06 · Monitoring

Two machines, ten-minute cadence

An on-box monitor checks the live site, the key APIs and that the nightly registry job actually ran, every ten minutes. A second, external monitor on a separate machine probes the public edge every ten minutes, so a dead origin produces an alert rather than silence. Both alert when a state changes, and the external monitor repeats its alert every 24 hours for as long as the on-box monitor is down. The same signals are published on /status; the measured cadences are on /sla.

07 · Third parties

Services in the path

Ridge does not claim any third-party certification. Enterprise security questionnaires are answered by the desk.

08 · Disclosure

Report a vulnerability

Report a security concern through /contact?plan=Security. The machine-readable contact is published at /.well-known/security.txt. Good-faith reports are acknowledged within one business day; Ridge asks that reporters do not access, alter or retain data that is not their own while testing.