Trust and security

Passkeys and 2-step verification for everyone; businesses can require them. Breached-password checks, rate limits, bot protection and device recognition on every sign-in. Re-authentication before sensitive changes such as payout accounts and ownership transfers.

Encryption in transit (TLS 1.2 or later). Files are stored in Cloudflare R2, which encrypts them at rest with AES-256. Secrets we hold for you, such as two-step verification keys, webhook secrets and credentials you save with us, are encrypted by our software with AES-256-GCM before they are stored. Our servers and databases run in a Contabo data centre in the European Union, and files are stored in Cloudflare R2 in its EU jurisdiction, which keeps them in the European Union. Staff access to production is limited to the people who need it, protected by strong sign-in and logged.

We take a backup before we change the database, and we keep a written incident response plan. We do not yet run scheduled off-site backups or regular restore tests, and this page will say so when we do. Personal data breaches are reported to the ICO within 72 hours where required, and to affected businesses within 48 hours.

We hold no security certification yet. We are working towards ISO/IEC 27001 and SOC 2 Type II, and we answer security questionnaires on request. No independent penetration test has been carried out yet. We plan an external test and will share its summary on request once it is done.

Please tell us at [email protected] before telling anyone else. See responsible disclosure.