Security & data handling

The Partner API serves data drawn from the German cooperative-banking sector. The controls below apply to every request, every credential, every endpoint.

Transport

• TLS 1.2 minimum, TLS 1.3 preferred. Older protocols are rejected at the edge.
• HSTS is enforced with a one-year max-age, includeSubDomains, and preload.
• Frame embedding is forbidden (X-Frame-Options: DENY).
• Referrer policy is strict-origin-when-cross-origin.
• HTTP traffic on port 80 is redirected to HTTPS — but treat HTTP URIs as unsupported, not "auto-upgraded". Don't ship http://api.valueverde.de/... in production code.

Credential handling

• OAuth2 client_credentials is the only partner authentication mechanism. See Authentication.
• Tokens are RS256 JWTs, short-lived (15 min), and signed by the keys at /.well-known/jwks.json.
• client_secret is stored hashed (Argon2id) — we cannot recover a lost secret; we can only rotate.
• client_secret rotation is operator-assisted via partner support; revocation is minutes.

What you should do

• Store client_secret in a secrets manager (AWS Secrets Manager, GCP Secret Manager, HashiCorp Vault) — never in source control, never in client-side code.
• Use a separate client_id per deployment (staging / production) so you can rotate independently.
• Verify TLS server certificates. Do not disable certificate verification, even for testing.
• If you cache access tokens in shared infrastructure, scope the cache to the (client_id) tuple and treat the cached token as sensitive.

What we log

Event	Retention	Purpose
Every request (method, path, status, client_id, request id, client IP)	90 days hot, 13 months cold	Operations, abuse investigation
Every authentication outcome (success, failure, reason)	13 months	Audit, fraud investigation

Request bodies are not retained beyond the immediate request lifecycle.

What you should log

• The X-Request-Id response header on every call. Quote it in support tickets — it correlates straight to our server logs.
• The full Problem Details body of any 4xx / 5xx response, including code, trace_id, and instance.

Do not log the full Authorization header or the full client_secret. Mask both to the first 8 characters before logging.

Data residency

All data is stored in Frankfurt (eu-central-1) with cross-AZ replication. There is no US or APAC replica today. We will publish a regional residency option when partner demand warrants it.

Vulnerability disclosure

Email security@valueverde.de with a description, reproducer, and impact assessment. We aim to respond within two business days. Coordinated-disclosure window is 90 days from acknowledgement.

Do not post vulnerabilities to GitHub issues, social media, or third-party paste services before we acknowledge.