This app runs on Heroku, so it inherits all of the security controls described here: https://www.heroku.com/policy/security