How we keep you safe

Every connection is encrypted with HTTPS. Passwords are stored only as one-way hashes. You can turn on passkeys and two-step codes (OTP).

Failed logins, too many requests, attack patterns (XSS, SQL injection, path tricks), signup bursts and bots are logged automatically and the IP is blocked for a while. Every minute we check that the site is up, its certificate and security headers, and that pages were not secretly changed.

Security logs are append-only and each entry carries the hash of the one before, so any edit shows up.

We collect only what we need. Payments are in test mode, so no real money moves. We do not hold external certifications (such as ISO) yet.