Security

Infrastructure

• Hosted on Cloudflare's network (a sub-processor). TLS everywhere, automatic DDoS protection.
• Data stored in a managed database, encrypted at rest.
• Secrets stored in the host's encrypted secret store, never in code.

Authentication

• Sign-in with Google (OAuth). We never see your password.
• Sessions use signed, HTTP-only cookies.
• API keys are stored hashed. We show a key once, when you create it.
• Every account route requires an active session or a valid API key.

Payments

We do not store payment cards. All billing flows go through Polar (our payment provider). Webhook signatures are verified before any state change.

Reporting a vulnerability

Found a vulnerability? Email hello@geondex.com with details. We'll respond within 72 hours and credit you publicly with permission.

Status

Live service status: see /status.