Security

In transit

All traffic is encrypted with TLS (HTTPS), and we enforce HTTP Strict Transport Security (HSTS) so connections are never downgraded.

Authentication & sessions

• Passwords are hashed with bcrypt and never stored in plain text.
• Sessions use HttpOnly, Secure, SameSite cookies to prevent theft and CSRF.
• Sign-in supports Google OAuth.

Application protections

• Rate limiting and a bot honeypot on registration to slow abuse.
• Security headers including Content-Security-Policy, X-Content-Type-Options, and frame protections.
• Row-level ownership checks so each account only ever sees its own data.
• Input validation on every API endpoint using strict schemas.

Reporting a vulnerability

If you believe you've found a security issue, please email security@personalizepro.com with details. We'll investigate and respond promptly. Please do not publicly disclose the issue before we've had a chance to fix it.