How we protect your data. No fluff - just facts.
- All traffic routed through Cloudflare
- DDoS protection and Web Application Firewall (WAF)
- Automatic SSL/TLS termination
- Global CDN for faster, safer delivery
- TLS 1.2+ for all data in transit
- AES-256 encryption for data at rest
- Password hashing with bcrypt
- API keys stored as HMAC hashes - never in plaintext
- JWT-based authentication with short-lived tokens
- Rate limiting on login and registration endpoints
- Account lockout after failed attempts
- Timing-safe comparison for verification codes
- PostgreSQL with encrypted connections
- Redis with TLS
- Hosted on Railway (SOC 2 compliant infrastructure)
- Automated backups and disaster recovery
- Input sanitization on all endpoints
- Parameterized SQL queries (no SQL injection)
- CORS and security headers configured
- Circuit breaker patterns for external service calls
- GDPR compliant - data export and deletion supported
- KVKK compliant (Turkish data protection law)
- No data sold to third parties
- No customer data used for AI model training
Have a security concern or want to report a vulnerability? Contact us at [email protected]