Skip to content
Ksarfr

Security

A security tool has to set the example

Here is what we do to protect your data and your signups’ data, and how to report a vulnerability.

What we do

Less data, better protected

No address in clear text

Your signups’ addresses are never stored or logged in clear text: only HMAC fingerprints, specific to each customer, are kept, then purged according to your retention period.

Encrypted accounts

Our customers’ and prospects’ addresses are encrypted (AES-256-GCM). Sign-in uses single-use magic links: no password to steal.

Protected API keys

Keys are stored as fingerprints, shown once, revocable at any time, with separate scopes (check, admin).

Per-customer isolation

Every piece of data belongs to one customer and is filtered on every request: a customer can never read another’s data.

Locked-down browser

Strict content security policy, HSTS, clickjacking protection, HttpOnly SameSite=Strict cookies, anti-CSRF token, origin checks.

Limits and anti-bot

Rate limits on signup, sign-in, public tools and the API; Cloudflare Turnstile anti-bot check on the free tools.

Restricted administration

Admin console outside any navigation, strong password, two-factor authentication and IP allow-list, limited attempts.

Hosting and backups

Hosted in the European Union. Encrypted database backups stored off the server, with a documented restore test. Payments handled by Stripe: no card ever goes through our servers.

Responsible disclosure

Found a vulnerability?

Please write to us before publishing anything. We take every report seriously.

  • Describe the issue and how to reproduce it; we acknowledge within 72 hours.
  • Do not access other people’s data beyond what is strictly needed to demonstrate the issue, and do not keep it.
  • No denial of service, social engineering or testing of our providers (Stripe, Cloudflare, Brevo).
  • Give us a reasonable delay (90 days at most) to fix before publishing.
  • We do not pursue researchers acting in good faith within these rules, and we thank them publicly if they wish.

Write to [email protected]· security.txt