Security

Designed to hold as little as possible

The safest data is data we never have. Plans are calculated and stored in your browser. We don’t ask for, and our forms warn against entering, phone numbers, card or account numbers, passwords, codes or government ID numbers.

How the site is protected

• HTTPS everywhere, with strict transport security.
• A content security policy, clickjacking protection and other security headers on every page.
• Input validation on every server request, and plans re-generated on the server from validated inputs when shared.
• Share links use 128-bit random IDs, expire, and can be revoked with a token only the creator’s browser holds.
• Rate limiting on searches, sharing and sign-in, using hashed network addresses.
• Administrator sign-in uses hashed passwords, short-lived sessions in secure cookies, and an audit log of content changes.

What we don’t claim

We don’t hold security certifications such as SOC 2 or ISO 27001, and the dependency map is a structural check of what you enter, not a security audit.

Reporting a vulnerability

If you find a security issue, please contact us through the details on our website. Please don’t access other people’s data or disrupt the service while testing.