How we keep your data and projects safe

The website

• Every page is served over HTTPS, and browsers are told to always use it.
• Strict security headers block framing of the site and limit where scripts can load from.
• Forms use spam checks and rate limits so bots cannot flood us.

Accounts and sign-in

• Accounts are invite only. You sign in with a one-time code sent to your email, so there is no password to steal or reuse.
• Important admin actions are written to an activity log.
• We never collect card numbers or mobile money PINs.

Your data

Data is kept in a managed database with infrastructure providers, and we keep only what we need. Project and partner requests are deleted 12 months after the last contact. Old notifications and activity entries are trimmed automatically.

Client projects

• Your domain is registered in your name, so you stay in control of it.
• Backups, monitoring and security updates are part of the maintenance agreement. The agreement states how often.
• When an agreement ends we hand over your files, database and DNS records.

Report a security problem

If you find a vulnerability, email us with the steps to reproduce it. Please do not open a public issue, do not access other people's data, and give us reasonable time to fix it before you share it. We read reports within a few working days. Our contact details are also in /.well-known/security.txt.

No system is perfectly secure, so we cannot promise absolute security. We can promise to take every report seriously.