Security

How we protect your data

• Encryption: TLS 1.2+ everywhere, with HSTS. Database, backups and storage are encrypted at rest by Azure.
• Accounts: passwords are hashed with PBKDF2 (ASP.NET Core Identity). Lockout after repeated failures, optional authenticator-app two-step verification, sign-out-everywhere, and email alerts for security changes.
• Secrets: stored in Azure Key Vault and reached through managed identities. No passwords in code or configuration files.
• Application: a strict Content Security Policy (relaxed only on Free-plan pages that show ads, and never on sign-in, account or billing pages), anti-forgery tokens on every form, rate limiting, parameterised database access, and output encoding.
• Minimisation: guests don't need accounts, IP addresses in security logs are truncated, and events delete themselves on a schedule.
• Payments: handled entirely by Stripe (PCI DSS Level 1). Card data never reaches our servers.
• Monitoring: centralised logging and alerting. If a personal data breach happens, we'll notify the regulator and affected people within the legally required time (72 hours for the regulator in the UK and EU).

Reporting a vulnerability

Found a security issue? Email help@joebishop.info with the details and steps to reproduce. Please don't access other people's data, degrade the service, or go public before we've had a reasonable chance to fix it. We won't take legal action against good-faith research that follows these rules. See also security.txt.