Security

Last updated: June 10, 2025

At , security is fundamental to everything we do. This page outlines our security practices and measures.

1. Data Encryption

• In Transit: All data is encrypted in transit using TLS 1.2+ (HTTPS)
• Authentication Tokens: JWT tokens signed with RSA-256 asymmetric cryptography
• Passwords: Hashed using industry-standard algorithms with per-user salt

2. Authentication & Access Control

• JWT-based authentication with short-lived access tokens and refresh token rotation
• OAuth 2.0 integration with Google for secure third-party authentication
• Cloudflare Turnstile for bot and automated attack prevention
• Rate limiting on authentication endpoints to prevent brute-force attacks

3. Infrastructure Security

• Services run behind reverse proxies with restricted access
• Database access is restricted and credentials are encrypted in configuration
• Regular security updates and dependency scanning

4. Application Security

• Cross-Origin Resource Sharing (CORS) configured with explicit policies
• JWT middleware validates every authenticated request
• Input validation on all API endpoints
• Audit logging for all mutating operations

5. Incident Response

We maintain a security incident response plan. In the event of a data breach, we will:

• Investigate and contain the incident within hours
• Notify affected users within 72 hours (per GDPR requirements)
• Provide a post-incident report detailing the cause and remediation steps

6. Compliance

7. Report a Security Issue

If you believe you have discovered a security vulnerability, please contact us immediately at . We appreciate responsible disclosure.

8. Contact

📧
🏢