Security at Renewly

Renewly is currently a demonstration build. It uses simulated product data and does not connect real financial, accounting, email, or vendor accounts. No real payments or vendor changes are performed by the demonstration.

• Least privilege: people and systems receive only the access needed for a specific task.
• Bounded authority: automated actions are designed to stay within explicit merchant, amount, and policy limits.
• Human control: actions outside an approved mandate require a person to authorize them.
• Traceable outcomes: important decisions and actions are designed to produce an auditable record.
• Data minimization: we aim to collect and retain only the information needed to provide and protect the service.

Controls in the current service include:

• Encrypted HTTPS connections in deployed environments.
• Security-focused browser headers and restrictive cross-origin policies.
• Schema validation and size limits for public form submissions.
• Rate limiting on public endpoints to reduce automated abuse.
• Request identifiers and structured operational logging for investigation.
• Environment-based secret handling so credentials are not committed with application code.

These safeguards reduce risk but do not make any internet service invulnerable. Controls will continue to evolve before Renewly handles production financial workflows.

If you believe you have found a security issue, use the Contact form in the landing-page footer and clearly label the message “Security.” Include the affected page or feature, steps to reproduce, and the potential impact. Please do not access other people’s data, disrupt the service, or publicly disclose an unresolved issue.

This page describes Renewly’s present security posture and design direction; it is not a certification or guarantee. We will update it as the product, infrastructure, and external assurance program mature.