How we protect your account and your data

• Passwords are hashed with argon2id

  We never store your password. It is turned into a one-way hash with argon2id (19 MiB of memory, 2 passes), the minimum profile recommended by OWASP. We cannot read it and we cannot email it to you.

• Repeated failures lock the account for a while

  After 5 failed attempts for the same email address and network address, sign-in is locked for 15 minutes. Signing in with an unknown email takes as long as a wrong password, so the form does not reveal which emails have accounts.

• Links in emails are single purpose and short-lived

  A verification link works for 24 hours. A password reset link works once and expires after 60 minutes. We store these tokens only as SHA-256 hashes, so a database copy does not contain a usable link.

• Google sign-in needs a verified email

  Continue with Google works only when Google confirms that the email address is verified, so nobody can claim an address that is not theirs.

• A reset signs out other devices

  Changing or resetting your password ends your other sessions. You can also use Sign out other devices in your settings at any time.

• Signed, protected session cookie

  Your session is a signed token in a cookie that scripts on the page cannot read (httpOnly) and that is not sent to other sites (SameSite Lax). On https it is also marked Secure. A session lasts up to 30 days and is renewed while you use the site.

• Suspended or deleted accounts stop at once

  The account is checked again on every request that needs it. If an account is suspended or deleted, or its password was reset, the session ends immediately, and role changes apply without a new sign-in.

• Four roles with different access

  Customers see only their own projects, orders, files and reports. Staff roles (worker, admin, super admin) get the admin panel, and each role sees only what it needs. Checks run on the server in every page and action; a coarse check at the edge of the app keeps signed-out visitors out of the dashboard, admin and checkout areas.

• We do not see or store card numbers

  Crypto payments happen on a hosted page of the payment provider, CoinPayURL. We store the plan, amount, method and payment reference of an order.

• Payment notifications are signed and verified

  When CoinPayURL confirms a payment it sends a notification signed with a secret key (HMAC-SHA256). We recompute the signature from the raw message and compare it in constant time. A message without a valid signature is refused and adds no credits. Oversized messages are refused, and a flood guard limits repeated attempts from one address.

• A notification cannot add credits twice

  Each provider event is stored once, identified by the provider's own event id. A repeated notification is recognised as a duplicate and ignored.

• Uploads are not public files

  Logos, screenshots, proofs and ticket attachments are stored on the server outside the public web folder. They are served through a route that checks that you are signed in and that you own the file or are staff. Anyone else gets the same answer as for a file that does not exist.

• Files are checked by their content

  We read the real file type from the file's own bytes and ignore the name and the type your browser claims. The file name must match the content, and size and minimum-size limits apply. An SVG that contains scripts, event handlers or external links is rejected.

• Safe delivery

  Files are served with headers that stop the browser from guessing types or running anything inside them. Profile photos are re-encoded to a small image, which removes embedded metadata.

• Saved secrets are encrypted

  Payment keys, mail passwords and other secrets saved in the admin panel are encrypted with AES-256-GCM before they reach the database. The encryption key lives in the server environment, not in the database.

• Report links can be revoked

  A shared report link uses a long random token. The owner can switch it off at any time, and a switched-off or unknown link answers as not found.

• Development helpers are off in production

  The helper routes and scripts used for local testing refuse to run on a production server.

• Rate limits

  Sign-up, sign-in, the contact form, the newsletter form, coupon checks, uploads and support messages are rate limited, so a script cannot hammer them.

• Your data on request

  You can delete your account in your settings. We remove your name, email, photo, sign-in methods and notifications. Order records are kept for accounting without your personal details.

• Security headers and a content security policy

  Every page is sent with a Content-Security-Policy, X-Content-Type-Options, a referrer policy and frame protection, and on the live site with Strict-Transport-Security for one year. The one known relaxation is that pages may run their own inline scripts and styles, because they are prerendered.

• No third-party trackers

  We use no analytics, advertising or third-party scripts, fonts or images. Pages load everything from our own address, apart from the Google profile picture of people who sign in with Google.

Open the live check

• We hold no security certification such as SOC 2 or ISO 27001, and we do not claim one.
• There is no two-factor authentication yet. Accounts are protected by a password, or by Google sign-in.
• No independent penetration test or external security audit has been done. Our checks are code review and automated tests.
• We do not scan uploaded files for malware (we check the file type and size), and the site has no firewall service in front of it that filters attacks on the network.
• We make no promise that nothing can go wrong. No online service can.

Last reviewed against the code on 4 November 2026

See also:Privacy policyCookie policyRefund policy