Security

• FaithClear uses HTTPS everywhere, httpOnly cookies for entry gate and session identifiers, and encryption for sensitive preference fields at rest where configured.
• Operator APIs require a separate internal secret. Billing webhooks verify provider signatures.
• Web responses apply explicit security headers including Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options.
• US public-launch review also requires auditable operator attestation and legal-review controls before the market is considered launched.
• Report security concerns to support@faithclear.com.