Security at Mosra
We build for educators and teams that share real work. This page summarises how we protect your data and how to report security issues.
Encryption everywhere
TLS 1.2+ for data in transit and AES-256 at rest. Secrets stored in Cloudflare Workers KV with envelope encryption.
Least-privilege access
Production access is limited to a small on-call rotation, gated by SSO, MFA, and short-lived credentials. All admin actions are audited.
Hardened infrastructure
Hosted on Cloudflare's global edge with DDoS protection, WAF, and bot mitigation. Application servers run in private networks with no inbound SSH.
Strong authentication
Password hashing with argon2id. Optional SSO (Google, Microsoft). MFA support on the roadmap for Team accounts.
Continuous scanning
Dependencies scanned daily, container images rebuilt weekly, and changes go through automated SAST checks before merge.
Compliance posture
GDPR-aligned controls, Vietnam PDPL compliance, and DPAs available on request. SOC 2 Type I assessment planned for 2026 Q4.
Vulnerability disclosure
We welcome reports from the security community.
Please email security@mosra.app with a clear description of the issue and steps to reproduce. We acknowledge reports within 2 business days and aim to fix high-severity issues within 14 days.
Please don't: run automated scanners that generate excessive traffic, attempt social engineering, or access accounts that are not your own. We don't have a formal bug bounty yet β recognition is shoutout-style and we ask for responsible disclosure.