Per Mei 2026, Akunpy operate 2 tahun (sejak Maret 2024) dengan track record: zero data breach, zero credential leak, zero compromise critical. Halaman ini detail security infrastructure untuk transparency publik + audit reference.
Note: dokumen ini designed untuk security researcher, enterprise customer compliance audit, akademisi yang research sharing economy security. Public CC-BY-4.0 license.
Security Architecture Overview
Akunpy security architecture multi-layer defense:
1. Transport Layer: TLS 1.3 + HSTS preload
2. Authentication: JWT RS256 + rotation + bcrypt password hashing
3. Data Layer: AES-256-GCM encryption at rest
4. Slot Isolation: Per-user encryption keys + password lock
5. Anti-Abuse: Rate limiting + anomaly detection
6. Monitoring: 24/7 SOC + automated alerting
7. Incident Response: Documented runbook + practice quarterly
8. Audit: Quarterly internal + annual external
Layer 1: Transport Security (TLS 1.3)
Spec:
• Protocol: TLS 1.3 ONLY (TLS 1.0/1.1/1.2 disabled)
• Cipher: AES-256-GCM with ECDHE key exchange
• Certificate: Cloudflare Universal SSL + Let's Encrypt fallback
• HSTS: max-age=63072000 (2 tahun) + includeSubDomains + preload
• HSTS Preload List: ✓ (registered Sept 2024)
Test result (SSL Labs A+): https://www.ssllabs.com/ssltest/analyze.html?d=akunpy.com
Layer 2: Authentication (JWT + bcrypt)
Spec:
• JWT signing: RS256 (asymmetric, public/private key)
• Token rotation: every 24 jam aktif
• Max session: 7 hari inaktif → auto-logout
• Password hashing: bcrypt cost 12 (current standard 2026)
• Salt: per-password random salt
• Optional MFA: TOTP support (Google Authenticator, Authy)
Test: try inspect cookies di browser. HttpOnly + Secure + SameSite=Strict flags semua set.
Layer 3: Data Encryption (AES-256-GCM)
Spec:
• Algorithm: AES-256-GCM (Authenticated Encryption with Associated Data)
• Key derivation: PBKDF2 dengan 600.000 iterations
• Key rotation: every 90 hari
• Encryption keys: stored di Cloudflare D1 encrypted + master key di HSM
• Backup encryption: same key hierarchy, backup ke S3 dengan KMS
Coverage:
• All user credentials
• Slot assignment data
• Session tokens
• Payment metadata (post-Midtrans/Xendit processing)
• Audit log entries
Layer 4: Slot Isolation (Akunpy Innovation 2024)
Per-user slot isolation system:
• Setiap user dapat slot eksklusif (private encryption key)
• Password lock individual (mandatory untuk Claude access)
• Chat history not shared di Akunpy server (proxy only)
• Cross-slot access impossible (cryptographically isolated)
Validation:
• Penetration test Q4 2024: pass
• Penetration test Q4 2025: pass
• External audit Q2 2026: pass
• Real-world: zero cross-user data leak in 2 tahun
Layer 5: Anti-Abuse System
Rate limiting:
• Per user: 13 messages / 5 hour rolling (sesuai claude.ai standard 2026)
• Per IP: max 100 req/second (DDoS protection)
• Per device: fingerprint-based untuk prevent multi-account abuse
Anomaly detection:
• Login pattern analysis (geographic, time-based)
• Unusual usage spike (>5x normal pattern)
• Fraud signal (mismatched user agent, suspicious payment)
• Auto-suspend trigger threshold tertentu
False positive rate: <0.5% (legitimate users accidentally flagged) — appeal via support unlock dalam 5 menit.
Layer 6: Monitoring & Alerting
Real-time monitoring:
• Grafana dashboard 24/7 untuk system metrics
• Telegram alert untuk: error spike, unusual login pattern, payment failure burst
• PagerDuty-equivalent on-call rotation untuk critical incident
• Log aggregation: 30-day hot storage + 1-year cold storage
Coverage:
• All authentication events
• All payment events
• All admin actions (audit trail)
• All API errors
Alert threshold:
• Critical: page within 5 menit (e.g., database down, payment gateway failure)
• Warning: notify within 15 menit (e.g., slow query, unusual error rate)
• Info: digest daily (e.g., new user signup volume)
Layer 7: Incident Response
Documented runbook untuk berbagai scenario:
1. Data breach (suspected/confirmed)
2. Account compromise (mass)
3. Payment fraud incident
4. DDoS attack
5. Database corruption
6. Critical bug in production
Process:
1. Detect (monitoring/alert/user report)
2. Confirm (within 15 menit)
3. Contain (within 1 jam — isolate affected components)
4. Investigate (within 4 jam — root cause)
5. Remediate (within 24 jam — fix + deploy)
6. Communicate (within 48 jam — post-mortem public kalau impact user)
7. Learn (post-mortem analysis + improvement)
Practice: tabletop exercise quarterly. Real incident drill annual.
Track Record 2 Tahun (Maret 2024 - Mei 2026)
Incident type breakdown:
• Critical incident (data breach, full outage): 0
• Major incident (partial outage >1 hour): 3 (Q4 2024 deploy issue, Q2 2025 DDoS, Q4 2025 Cloudflare network)
• Minor incident (degraded performance): ~30 (sebagian besar resolve <30 menit)
• Customer-impacting bugs: ~50 (avg time-to-fix 4 jam)
Outage time total tercatat rendah selama 2 tahun operasi — gangguan slot dipulihkan otomatis via auto-recovery.
Customer compensation (extend subscription) saat outage major: 3 incidents = total ~6 hari extend untuk 8K+ users impacted.
Audit History
Q4 2024: External security audit pertama. Vendor: Indonesian security firm. Scope: infrastructure + application code review. Findings: 0 critical, 2 medium (resolved within 30 hari), 5 low (resolved within 90 hari). Report: available via NDA untuk enterprise customer.
Q4 2025: External security audit kedua. Vendor: Singapore-based regional firm. Scope: expanded include penetration test + social engineering. Findings: 0 critical, 1 medium (resolved within 14 hari), 3 low (resolved within 60 hari).
Q2 2026 (Mei): Internal comprehensive audit. Findings: 0 critical, 0 medium, 4 low (improvement opportunities). Report: this document.
Future audit: SOC 2 Type II audit planned Q4 2026 untuk enterprise customer requirement.
Compliance Status
Akunpy compliant dengan:
• ✓ UU ITE 2008/2016 (Indonesia)
• ✓ UU Perlindungan Konsumen 1999
• ✓ UU PDP 2022 (Personal Data Protection)
• ✓ PP 71/2019 (PSE registration)
• ✓ OWASP Top 10 2021 mitigations
In progress:
• ⏳ SOC 2 Type II certification (target Q4 2026)
• ⏳ ISO 27001 certification (target 2027)
• ⏳ Pre-audit untuk EU GDPR compliance (untuk global expansion 2027+)
Bug Bounty Program
Akunpy welcome responsible disclosure dari security researchers. Reach: support@akunpy.com dengan subject "Security Disclosure".
Reward (per severity):
• Critical (data breach, RCE, auth bypass): Rp 5-15 juta
• High (privilege escalation, sensitive info disclosure): Rp 1-5 juta
• Medium (CSRF, XSS, SQLi mitigated): Rp 500K-1 juta
• Low (info leak, version disclosure): Rp 100-500K
• Honorable mention (out-of-scope or low-impact): Akunpy Pro 1 tahun free + public credit
Hall of Fame: /keamanan/hall-of-fame (kalau ada — currently empty karena 0 valid bug bounty in 2 years).
Compare to Industry Average
Sharing platform industry (informal Discord/Telegram resellers):
• Data breach: multiple reported incidents per year per platform
• Encryption: often weak or plaintext
• Audit: typically none
• Monitoring: ad-hoc
• Incident response: undefined
Enterprise SaaS standard (Anthropic, OpenAI):
• Data breach: occasional (e.g., OpenAI March 2023 ChatGPT exposed user data 9 jam)
• Encryption: AES-256+
• Audit: SOC 2 Type II + ISO 27001
• Monitoring: 24/7 SOC professional
• Incident response: well-defined
Akunpy positioning: aspire to enterprise SaaS standard. Already above sharing industry standard. Gap closing dengan certification target 2026-2027.
Untuk Enterprise Customer
Compliance documentation available under NDA:
• Detailed security architecture diagram
• Latest external audit report
• Data Processing Agreement (DPA) template
• Sub-processor list
• Incident response runbook
• Penetration test results
Hubungi partnership@akunpy.com untuk request.
Kesimpulan
Akunpy 2 tahun operasi dengan zero data breach + strong security architecture. Multi-layer defense, regular audit, transparent track record. Above-industry standard untuk sharing platform, approaching enterprise SaaS standard. Untuk enterprise customer, full compliance documentation tersedia under NDA. Trust verified by track record, bukan marketing claim.