In short
- Everything is served over TLS and encrypted at rest.
- Two-factor authentication is available to every account.
- Every administrative change is written to an audit log.
In transit and at rest
Everything is served over TLS. Stored uploads and generated assets are encrypted at rest.
Accounts
Passwords are hashed with a memory-hard function and never stored or logged in the clear. Two-factor authentication is available to every account from the profile page, with single-use recovery codes.
Access
Administrative access is limited to the people whose role needs it, and every administrative change is written to an audit log with the actor, the target and the change.
Reporting a vulnerability
Send findings to the support address with enough detail to reproduce. We will confirm receipt and keep you updated.
Reporting in good faith? We will not pursue anyone who reports in good faith and does not access other people’s data. Start from the support page.