Security
Last updated: August 10, 2026
Infrastructure
- The application is hosted at OVH, on a server located in Warsaw, Poland (EU).
- The PostgreSQL database runs on the same server as the application.
- The application listens only on a local address and is reachable only through a reverse proxy.
- All traffic passes through Cloudflare, which acts as a CDN/proxy layer in front of the server.
Encryption in transit
- Traffic is encrypted with TLS end-to-end: from the browser to Cloudflare and from Cloudflare to the origin server (Let’s Encrypt certificates).
- The session cookie is issued only with the
SecureandHttpOnlyattributes.
Authentication and access
- Passwords are hashed with bcrypt at cost 12; older hashes are automatically upgraded to the current parameters.
- Every login requires two-step e-mail verification: a one-time code valid for 3 minutes, with a limit of 5 attempts.
- Failed login attempts trigger automatic lockouts — per account and per address, with escalating lockout duration.
- Sessions are stored in the database and are valid for 24 hours.
Application security
- Application endpoints are rate limited.
- CSRF protection is based on request origin verification.
- The application sets security headers, including Content-Security-Policy (via helmet).
- Integration secrets (Stripe, OAuth, AI) are stored in the database encrypted with AES-256-GCM.
- API tokens are stored as hashes only; each token has permission scopes, an expiry date, and can be revoked at any time.
Data minimisation
- Consent records contain no IP address, user agent, or visitor identifier — see Data processing for details.
- Data is deleted automatically according to retention periods — see Data retention for details.
Reporting security issues
Found a vulnerability? Write to support@cookiehug.com (subject: Security). We respond on business days.