Security
How we protect your data
What protects your account and your data today, and how to tell us about a problem.
Safeguards in place today
- Encrypted connections
- The website and the app load only over HTTPS, delivered through Cloudflare.
- Data in Kazakhstan
- Accounts, briefs and financial records are stored in a data centre in Kazakhstan. The privacy notice lists the exceptions, such as email delivery.
- Protected sign-in
- Passwords are stored only as secure hashes. Staff and company accounts must use two-factor sign-in.
- Limited access
- What each person can see depends on their role. Status changes on accounts, contracts, invoices and payouts are written to an audit log.
- Encrypted backups
- The database is backed up every night, and the backups are encrypted.
Report a security problem
If you find a vulnerability, email us with “Security” in the subject. Tell us which page is affected and how to reproduce the problem. We do not run a paid bug bounty.
- Do not open, change or delete anyone else’s data.
- Do not run tests that could slow down or interrupt the service.
- Give us reasonable time to fix the problem before you make it public.