Security Overview

This page answers a security review without a call. It describes what we actually do, and says plainly where a control is basic rather than dressing it up. It forms part of the data processing addendum. Brokerage accounts can request the signed pack, with the answers keyed to their own questionnaire, from the Invoicing page in their panel.

How you get in

There is no password on this product, by design. Your panel is reached by a private link mailed to the address on the account, and that link is the credential. It follows that:

• There is no password to guess, reuse or leak, and no password database to steal.
• A link that nobody has used for a month stops working, and a fresh one is one form away. Every visit pushes that deadline forward, so a seller who comes back regularly never meets it.
• Links are stored only as a SHA-256 hash. We cannot read your link back out of our database, which is also why a lost link is replaced rather than resent.
• Revoking a seat clears its link immediately, and a revoked seat is refused even if the old link is still in somebody's inbox.
• Panel pages are served with noindex and no-referrer, so a link does not leak to a search engine or to the next site you visit.

If your own identity policy has requirements of its own, write to [email protected] and we answer them in writing, alongside the security review pack on Brokerage.

Seats and permissions

A seat is owner, broker or viewer. Only the owner seat changes billing, seats or the plan. A viewer cannot change the book. The role is checked on the server for every request, not by hiding a button: the panel link is the credential, so anybody holding one can type a URL, and each route asks what the seat and the plan allow before it does anything.

Payments

Card details never reach our systems. Payment is taken on our payment operator's secure page in your browser, and what we store is a customer and subscription identifier from that operator. We cannot see, and do not hold, a card number. Invoices, receipts and cancellation live in the billing portal, reached from your panel.

Data in transit and at rest

• Every connection is HTTPS. Plain HTTP is answered with a permanent redirect, and session cookies are marked secure.
• The application and its database run on dedicated servers with an EU hosting provider in Germany. The database is not reachable from the internet: it accepts connections from the application host only.
• Administrative access is SSH with key authentication by named administrators. Passwords are not accepted for shell access.
• Secrets (payment keys, mail credentials) are held in the server environment file, readable by the application account only, and never in the code repository.

The audit log

Every change on a seller book is recorded: the seat that made it, what changed, the time, and the IP address it came from. The log is append-only, and nothing in the application edits or removes a line, including for us. Brokerage accounts read it on screen and export the whole thing as a CSV they keep outside our systems. Accounts on other plans are recorded the same way, so the log is complete from the day the account opened.

Abuse and rate limits

Every form that costs money, sends mail or changes a book is rate limited per address and per action. Offers and bids are confirmed by a code mailed to the buyer, so a name on your sales page cannot be buried under unverified contacts. Public forms carry bot traps, and a submission that trips one is refused without telling the bot why.

Backups and recovery

The server is snapshotted by the hosting provider, and a dump is taken by hand before any change to the database schema. We do not run a scheduled off-host backup, and we do not offer a contractual recovery time objective. Both belong in a brokerage agreement if your policy needs them, and we would rather write that here than imply a programme we do not run. Your own book is exportable at any time: the audit log and every appraisal run download as CSV from your panel.

Third parties that see your data

Four categories, listed with what each is for and where it sits, in section 4 of the data processing addendum: an EU hosting provider, a payment operator, an email delivery provider and a DNS and network protection provider. We do not sell data and we do not pass it to anybody else.

Reporting something

Email [email protected] with anything you have found. We answer within two working days, we do not threaten people who report problems honestly, and we tell affected accounts within 48 hours of confirming a breach that touches their data.

What we do not claim

We are not SOC 2 or ISO 27001 certified, and we will not imply it. There is no bug bounty programme and no 24/7 on-call rota. Anything above that you need contractually is a conversation, and the answer will be in the agreement rather than a badge on a page.