Last updated Feb 2026. We take the trust of our clients and experts seriously. This page summarizes the technical and operational controls currently in place at AdviceLine, as well as the roadmap for formal audit attestations.
All traffic to adviceline.co is served over HTTPS/TLS 1.2+. HTTP requests are automatically upgraded.
Passwords are hashed with bcrypt (industry-standard, computationally expensive). AdviceLine never stores or logs plaintext passwords. JWT access tokens are signed with a rotated secret.
All card payments are processed by Stripe, a Level 1 PCI-DSS certified provider. Card numbers never touch our servers — Stripe tokenizes before anything reaches AdviceLine.
Hosted on a managed Kubernetes platform with isolated containers, automated TLS renewal, and MongoDB persistent storage with authenticated access via a private connection string.
Three strict roles — user, expert, and admin — gated by JWT claims on every API call. Admin endpoints are protected and audited; experts can only edit their own profile.
IP address, timestamp, and document version are captured on every Terms of Service and Expert Agreement acceptance. Non-repudiable record of consent, available to legal counsel on request.
Every refund request is reviewed by a human admin — no auto-refunds — to shield experts from fraudulent claims and users from fraudulent experts. Expert payouts on disputed sessions are held until resolution.
Transactional email is sent from our verified domain (welcome@adviceline.co) via Resend with SPF, DKIM, and DMARC alignment to prevent spoofing.
AdviceLine is a consumer marketplace, not a healthcare provider, fiduciary, or law firm. We do not currently store protected health information (PHI) or offer regulated financial advice. The following summarizes our standing against common frameworks:
| Framework | Status | Notes |
|---|---|---|
| PCI-DSS | Covered via Stripe | Stripe is Level 1 PCI-DSS certified. AdviceLine falls under SAQ A (merchant that fully outsources card data handling). |
| SOC 2 Type I | Not yet pursued | Planned once an enterprise customer or investor requires it. Readiness target: 90 days from kickoff with Vanta / Drata. |
| SOC 2 Type II | Not yet pursued | Follows Type I with a 6–12 month observation window. |
| GDPR / CCPA | Honoring requests | Users may request data export or deletion by emailing privacy@adviceline.co. |
| HIPAA | Out of scope | AdviceLine is not a HIPAA covered entity. Experts must not transmit PHI through the platform. |
Security researchers are welcome. If you discover a vulnerability, please email security@adviceline.co with reproduction steps. We ask that you refrain from automated scanning, publicly disclosing issues before we've had a chance to respond, or accessing data that does not belong to you. We aim to acknowledge reports within two business days.
Account security is a partnership. Please use a strong, unique password, never share your login, log out on shared devices, and report any suspicious activity on your account immediately.