Security at Mission Control

1. Trust & Security Overview

Mission Control centralizes operational, reporting, connected-system, and account activity that may be sensitive for customers and internal teams. Because of that, the platform is designed to support strong authentication, verification, logging, privacy controls, and operational review workflows.

Security responsibilities are shared. Mission Control maintains platform-level safeguards, while each customer remains responsible for managing authorized users, internal approval decisions, connected third-party permissions, and appropriate use of exported or integrated data.

Mission Control currently relies on vetted infrastructure providers including DigitalOcean for core hosting and application operations.

2. Account Protection

Mission Control supports multiple account protection controls intended to help confirm user identity and reduce unauthorized access risk.

• Email and password authentication.
• Google Sign-In and Microsoft account authentication.
• Email verification codes are used for supported account verification and recovery workflows.
• Optional SMS verification with Twilio can be used for account security, verification prompts, and suspicious activity review.
• Suspicious activity detection can trigger additional login verification or account checks.
• Phone numbers are only saved as trusted security numbers after successful code confirmation.
• Users can manage verified phone numbers from their profile or security settings.
• Unverified phone numbers are treated as pending values and are not promoted to trusted account security numbers until verification succeeds.

3. Multi-Factor & Adaptive Verification

Mission Control may require additional verification when suspicious activity is detected or when a higher-risk account event needs extra confirmation.

• Verification may occur through email or SMS depending on the workflow and account state.
• Mission Control may require additional verification for risky sign-ins, unusual activity, or sensitive account security actions.
• SMS codes are used for account security, not marketing.
• Verification codes expire and may be rate-limited to reduce abuse and repeated guessing attempts.
• Privileged internal access may require additional re-verification based on account role and security policy.

4. Platform Security Controls

Mission Control includes platform-level controls designed to protect customer accounts, support least-privilege access, monitor suspicious activity, and maintain an auditable record of security-sensitive events.

These controls are designed with SOC 2-aligned practices in mind, built to support auditability, access control, and security monitoring, and security controls are actively maintained and improved.

5. Suspicious Activity Monitoring

Mission Control monitors security-relevant account and session behavior to help identify access patterns that may require additional review or verification.

• Login from a new device
• Login from a new IP address
• Unusual location
• Repeated failed login attempts
• Suspicious session behavior

When appropriate, suspicious activity can trigger verification prompts, session invalidation, internal review, or follow-up security investigation.

6. Super Admin Audit Logging

Security-sensitive events are logged for internal audit, monitoring, and investigation workflows. These logs are intended to support accountability, operational review, and incident response.

• Authentication events and login outcomes
• Verification attempts and verification failures
• Admin actions and privileged security changes
• Suspicious activity detections
• Account security changes such as phone verification, session revocation, and related account-protection events

Phone numbers are masked in logs where applicable. Verification codes, raw secrets, and sensitive credentials are not logged.

7. Data Protection

Mission Control applies safeguards designed to support confidentiality, integrity, and privacy of customer and account data.

• Encryption in transit using HTTPS/TLS
• Secure handling of sensitive account data
• Least-privilege access practices for internal operations
• Secure credential and secret handling
• Privacy-conscious logging and operational telemetry
• Restricted access paths for administrative and security-sensitive workflows

No internet-based service can guarantee absolute security. Mission Control does not claim immunity from all vulnerabilities, attacks, outages, or unauthorized activity.

8. Privacy & User Control

Mission Control is designed to give users visibility and control over security-related profile data while avoiding promotional use of security contact information.

• Phone numbers are used only for security verification, suspicious activity alerts, and account recovery.
• Users can update or remove phone numbers from profile or security settings, subject to account security checks.
• Unverified phone numbers are not stored as trusted 2FA numbers.
• Mission Control does not describe or use security SMS messages as promotional messaging.

Additional details about how Mission Control handles personal information are available in the Privacy Policy and Terms of Use.

9. Subprocessors & Service Providers

Mission Control uses service providers to support infrastructure, communications, security workflows, and platform operations. The current list is available on the Subprocessors & Vendors page.

Twilio is used for SMS verification and security messaging. Twilio may process phone numbers, verification metadata, and SMS delivery metadata for security purposes.

Customers and reviewers can use the public Subprocessors page to review current vendors, change history, and subscription options for vendor updates.

10. Incident Response & Monitoring

Mission Control maintains monitoring and internal review workflows intended to support investigation and response when security issues or suspicious activity are identified.

• Security events are monitored.
• Suspicious activity can trigger additional verification.
• Internal review workflows and audit logs support investigation and response tracking.
• Operational and security logging supports internal escalation and follow-up analysis.

11. Compliance Roadmap

Mission Control is actively building and maintaining security controls aligned with SOC 2 best practices. Formal compliance status will be updated if and when certification is completed.

We do not currently claim SOC 2 certification on this page. Security, privacy, and compliance materials may be updated over time to reflect operational improvements, vendor changes, legal requirements, and product evolution.

12. Security Questions & Support

Have a security question? Contact support or review our Privacy Policy, Terms of Use, Help Center, and Subprocessors.

• Contact Support
• Privacy Policy
• Terms of Use
• Help Center
• Subprocessors & Vendors

If you believe you have discovered a security vulnerability in Mission Control, please report it to security@stranded.me.