Security
Protecting your data and account is our top priority. Here's how we do it.
Encryption
In transitTLS 1.3 for all client-server communication
At restAES-256-GCM for sensitive data in the database
Passwordsbcrypt with 12 rounds, never stored in plaintext
TokensJWT with HS256 and regular key rotation
Infrastructure
- Where it runs — a dedicated application server; database and job queue in the EU (Frankfurt); CDN and video by Cloudflare (global network); encrypted backups
- Network-level firewall — traffic filtering and DDoS mitigation at the Cloudflare edge
- Tenant isolation — each account's data is logically isolated in a shared database; every request is checked against the signed-in account
- Automated backups — daily + weekly, encrypted, stored in a separate region
- Zero-trust architecture — every request is authenticated, including internal ones
Monitoring & Oversight
- Automated monitoring of system components, with alerts to the team
- Immediate alerts on suspicious activity
- Detailed audit logs retained for 90 days
- Code and security reviews before every release
Your tools to protect your account
- Two-factor authentication (2FA) — TOTP compatible with Google Authenticator, Authy, etc.
- Session management — see all active sessions and sign out of every device in one click
- Change history — every important account change is logged
Compliance
GDPRFull compliance with EU regulation
CCPACompliance with the California Consumer Privacy Act
PCI-DSSAll payments handled by PCI Level 1 providers
Privacy lawsCompliance with applicable data-protection laws
Responsible disclosure
Found a security vulnerability? We value responsible security researchers. Send a report to [email protected] with a description and steps to reproduce. We will acknowledge it, keep you updated and credit you. Please do not disclose it publicly before it is fixed. (There is no paid bounty program at this time.)
Contact
Security questions or incident reports: [email protected]