Security
Your professional record is personal. Here is how we protect it.
Last updated 4 November 2026 · Version 2026-11-04
Passwordless sign-in
One-time codes and Google sign-in. No passwords to leak or reuse. Codes are stored only as hashes and expire in 10 minutes.
Revocable sessions
Short-lived access tokens, hashed refresh tokens, and the ability to end every session at once.
Private documents
Credential documents live in private storage and are only opened through short-lived signed links, by their owner.
Abuse protection
Rate limits on sign-in, AI, uploads and public forms, a daily cap on emails, and network-level bot and attack filtering.
Protected admin access
Administrator actions require a second factor (TOTP) on the server, and every admin action is logged.
Strict browser policy
Content Security Policy with per-request nonces, HSTS, framing protection and secure, HttpOnly cookies.
What we do
- Encrypt data in transit (HTTPS everywhere, with HSTS).
- Keep secrets out of the code and rotate them when needed.
- Check every request against the signed-in user, so people can only read and change their own data.
- Apply rate limits and bot protection, and keep an audit trail of administrator actions.
- Remove unsafe file types from public uploads (for example SVG) and limit file sizes and formats.
- Run automated tests and dependency checks, and fix security issues as a priority.
No system is perfectly secure, so we also plan for failure: we can revoke sessions immediately, and we will notify you and the authorities of a personal data breach as the law requires.
Report a vulnerability
If you believe you have found a security issue, email [email protected] with the details and steps to reproduce it. Please do not access other people's data, disrupt the service, or disclose the issue publicly until we have had reasonable time to fix it. We will acknowledge your report within 24 hours, keep you updated, and credit you if you wish.