How we protect your account

Sign-in is handled by Firebase Authentication. After you sign in, the server issues an HttpOnly, Secure, SameSite session cookie — it cannot be read by JavaScript and is verified on the server for every protected request.

The server never trusts an identity supplied by the browser. Email verification is required before you can reach the application, and signing out revokes your session.

Sensitive account and verification state can only be written by trusted server processes, never by a client. Database security rules deny any direct client write to identity or status fields and block all client access to internal audit records.

Identity-verification results arrive over a cryptographically signed callback; a forged result cannot change your verification status.

Connections are encrypted in transit (HSTS enforced) and data is encrypted at rest by our infrastructure provider. Identity documents are processed by our verification provider; we retain verification outcomes and an audit trail under server-only access.

Logs capture identifiers and event outcomes only — never identity documents or other sensitive personal data.

If you believe you have found a security issue, please contact us before disclosing it publicly. We welcome good-faith research and will work with you to validate and resolve issues.