# Nolgard security

> How Nolgard stores data, protects secrets and portal accounts, and how to report a vulnerability.

Source: https://nolgard.com/security/
Last updated: 2026-10-25

Last updated / 25 October 2026

# Security

What we do today. Nothing on this page is a certification.

## Storage

- Data is stored in Cloudflare's EU jurisdiction (D1 and Durable Objects). The edge is global.
- Raw IP addresses are not stored. Network identifiers are salted hashes.
- Retention follows the [retention table](https://nolgard.com/privacy/#retention).

## Secrets

- Site secrets are stored as SHA-256 hashes. The portal shows only the last four characters.
- Rotating a secret stops the old one immediately.

## Portal accounts

- Sign in with a passkey or a single-use email link that expires after 15 minutes.
- Sessions use a secure, HttpOnly cookie. Portal API calls must come from the same origin.

## Transport and headers

- HTTPS only, with HSTS (`max-age=31536000; includeSubDomains`).
- Pages send `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff` and a strict referrer policy. The portal, docs and legal pages also send a Content Security Policy.

## What we don't have

- No SOC 2 or ISO 27001 report.
- No SLA.

## Report a vulnerability

Email [privacy@nolgard.com](mailto:privacy@nolgard.com). See [security.txt](https://nolgard.com/.well-known/security.txt). Subprocessors are listed on [subprocessors](https://nolgard.com/subprocessors/).