Security

What we do today. Nothing on this page is a certification.

Storage

• Data is stored in Cloudflare's EU jurisdiction (D1 and Durable Objects). The edge is global.
• Raw IP addresses are not stored. Network identifiers are salted hashes.
• Retention follows the retention table.

Secrets

• Site secrets are stored as SHA-256 hashes. The portal shows only the last four characters.
• Rotating a secret stops the old one immediately.

Portal accounts

• Sign in with a passkey or a single-use email link that expires after 15 minutes.
• Sessions use a secure, HttpOnly cookie. Portal API calls must come from the same origin.

Transport and headers

• HTTPS only, with HSTS (max-age=31536000; includeSubDomains).
• Pages send X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a strict referrer policy. The portal, docs and legal pages also send a Content Security Policy.

What we don't have

• No SOC 2 or ISO 27001 report.
• No SLA.

Report a vulnerability

Email privacy@nolgard.com. See security.txt. Subprocessors are listed on subprocessors.