Sign-in
Passwords are hashed with argon2id using OWASP’s recommended parameters and are never stored or logged in plain text. Passwords found in known data breaches are refused at sign-up. You can turn on two-factor authentication with any authenticator app and keep backup codes for when you lose your phone.
Sessions
Sessions live in the database and are referenced by an httpOnly, SameSite cookie. Signing out elsewhere, changing your password or resetting it ends every other session immediately.
Your data is yours alone
Every record carries the id of the owner, and the data layer refuses any query that does not filter by it. A request for another owner’s property returns not found, never their data.
Documents
Uploads are checked by their bytes, not their file name, and stored under an opaque key in a private bucket that is not publicly addressable. Files are served only to the signed-in owner, with no caching.
Audit log
Sign-ins, sign-outs, password changes, two-factor changes and document uploads are recorded with the time, IP and browser.
Reporting a problem
If you believe you have found a security issue, write to hello@deedroll.com. We read every report.