Security
Keeping Customer Data Safe: Our Approach to Security
Every website and app we build handles someone's information: a name, an email address, an account, an order. Keeping that safe is not a feature we add at the end. It shapes how we design, build, and run everything. Here is how we approach it on the web and on mobile.
Built on proven foundations
Our websites and back-end services run on a mature, widely used web framework, and our mobile apps are built with a well-established cross-platform toolkit for Android and iOS. Both are maintained by large communities and receive regular security fixes, so we start from tested building blocks instead of writing sensitive code from scratch.
Encrypted connections
Our websites and services are served over HTTPS, and our apps talk to our servers only over encrypted connections, so data moving between your device and our systems cannot be read along the way.
Passwords and sign-in
- Passwords are never stored in readable form. They are hashed with a strong, slow algorithm, so even we cannot see them.
- Sign-in and password-reset forms are rate-limited to slow down password guessing.
- On mobile, sign-in tokens are kept in the phone's secure storage rather than in plain app files.
Protection against common web attacks
Database queries are built with parameter binding to block SQL injection. Pages escape what users type before showing it, which stops cross-site scripting. Forms carry tokens that block cross-site request forgery.
The server checks everything
We never trust a request just because it came from our own app or website. Every input is validated on the server, and every action is checked against what that user is allowed to do, so one account cannot read or change another's data.
Secrets stay out of the code
Keys, passwords, and other sensitive settings live in server configuration, not in source code or inside the apps we publish. An app downloaded from a store contains nothing that would unlock our servers.
Collect less, protect more
The safest data is data we never collect. We ask only for the information a product actually needs to work. Fewer stored details mean fewer things that can ever go wrong.
Limited access and updates
Only the people who need access to a system have it, and server access uses keys rather than shared passwords. We keep our frameworks and libraries up to date and apply important security fixes when they are released.
Found a problem?
If you believe you have found a security issue in one of our products, please contact us privately with the details so we can investigate and fix it. We appreciate responsible reports and will reply as quickly as we can.