Encryption at rest and in transit

Traffic to our site is encrypted in transit, database backups are encrypted before they leave our hosting provider, and tax numbers are encrypted again inside the application.

Backups

Database backups are encrypted with AES-256-GCM before they leave our hosting provider, and the key is kept outside our code repository.

In transit

Every request to our site is redirected to HTTPS, and browsers are told to use HTTPS only for one year (HSTS). The TLS version is the newest one your browser and our network provider both support.

Application-layer encryption for credentials

Contractor tax IDs (SIN, SSN, EIN) receive an additional layer of encryption with Fernet (a standard authenticated-encryption scheme) before being written. This is defense-in-depth: a database breach alone would not expose these credentials.

We do not collect passwords

We never ask for the passwords to your business accounts, and we never ask for access to your systems or mailboxes. Everything we check is observed from outside.

More detail

See our Security page for the technical specification.