Security & data handling

This note summarises how Thind Ventures Ltd. (“we”, “us”), operating as Athon Labs, protects data when we build and run software for clients — payroll, field operations, gate photos, invoices, and the rest. It is intended for vendor reviews and security questionnaires. Personal information on this marketing site is covered separately in our privacy policy.

Where data lives

Client systems we build and operate run on Cloudflare (Workers, static assets, queues, and related services). Application data is stored in Cloudflare managed services (for example D1, R2, KV, or Durable Objects) chosen per project. Data is processed at Cloudflare edge locations; where a client requires a specific region, we configure storage and processing accordingly — typically Western North America for Canadian clients.

This marketing site at athonlabs.com is also hosted on Cloudflare. Contact-form submissions are queued and processed by a dedicated Cloudflare Worker before email delivery.

Hosting and infrastructure

• All traffic is served over HTTPS (TLS 1.2+).
• Cloudflare provides DDoS protection, WAF, and bot management at the edge.
• Production and staging environments are separated per client project.
• Secrets and API keys are stored in Cloudflare environment bindings or encrypted configuration — not in source code.
• Dependencies are pinned and updated on a regular cadence; critical patches are applied promptly.

Access controls

Access to client data follows least-privilege and need-to-know principles:

• Athon Labs staff. Only named team members assigned to a client project can access that client's production systems. Access is granted individually and revoked when no longer required.
• Client users. Client-facing applications use role-based access control. Permissions are scoped to what each role requires (for example dispatchers, field crews, or administrators).
• Authentication. We use strong passwords and multi-factor authentication on all administrative accounts and infrastructure consoles.
• Logging. Administrative access and significant actions are logged. Logs are retained per project requirements and reviewed when investigating incidents.

We do not sell client data or use it for purposes unrelated to delivering the contracted service.

Backups and recovery

• Production databases and file storage are backed up on a schedule agreed in each client contract.
• Backups are encrypted at rest and stored separately from primary data.
• We test restore procedures periodically and can provide recovery-time objectives on request.
• Source code is version-controlled in private repositories with branch protection on main branches.

Subprocessors

We use the following subprocessors to deliver our services. Client-specific subprocessors (for example payment or SMS providers chosen for a project) are listed in individual statements of work.

• Cloudflare, Inc. — hosting, CDN, edge security, managed databases and storage, and observability for client applications and this website.
• Cloudflare Email Routing / Workers send email — delivery of contact-form notifications and transactional emails from this site.
• logo.dev — company name and logo lookup by email domain on the contact page only; no client operational data is sent.

We assess subprocessors before engagement and require them to maintain appropriate security controls. Changes to this list are reflected in an updated “Last updated” date on this page.

How to report a security issue

If you believe you have found a vulnerability, or need to report a suspected data incident involving systems we operate for you, contact us immediately:

• Email: security@athonlabs.com (subject line: “Security”)
• Include a description of the issue, steps to reproduce if applicable, and your contact details.
• We aim to acknowledge reports within one business day and will keep you informed of progress.

Please do not publicly disclose vulnerabilities before we have had a reasonable opportunity to investigate and remediate.

Changes

We may update this note from time to time. The “Last updated” date at the top of this page will change when we do.