Security

Last updated: TBD — set on publish

This page describes protections that genuinely exist in usort today. We've kept it to claims we can back up rather than generic "bank-grade security" language — please keep it that way as the product evolves, and review it whenever the underlying implementation changes.

Account protection

  • Password hashing — passwords are never stored in plain text. We hash them with bcrypt before storing anything.
  • Two-factor authentication — you can enable TOTP-based two-factor authentication (compatible with apps like Google Authenticator or 1Password) from your account settings, with single-use backup codes for account recovery.
  • Session control — sign-in sessions expire automatically, and you can view and revoke your active sessions from account settings. Deactivating your account immediately signs out every session.
  • Third-party sign-in — if you sign in with Google, GitHub, or Microsoft, we never see or store your password on that provider.

Protecting your data

  • Visitor privacy in analytics— we don't store the raw IP address of people who click your links or scan your QR codes. We compute a salted, one-way hash to count unique visitors, and discard the original address. Location data is resolved locally, without sending visitor IPs to any outside service.
  • Payment data — we never handle or store your card details. Payments are processed directly by Razorpay, a PCI-compliant payment processor; we only receive a purchase amount and an order reference.
  • Sensitive fields are excluded from logs— passwords, tokens, and authorization headers are automatically redacted from our internal application logs before they're ever written.

Abuse prevention

  • Rate limiting — sign-in, registration, and content-creation endpoints are rate-limited to slow down automated abuse and credential-stuffing attempts.
  • Link scanning — destination URLs are screened against known-bad patterns before a short link is created, to catch obviously malicious or deceptive links.

Responsible disclosure

If you believe you've found a security vulnerability in usort , please tell us before disclosing it publicly — we want the chance to fix it first. Email support@usort.xyzwith as much detail as you can (steps to reproduce, affected endpoint, potential impact). We don't currently run a paid bug bounty program, but we investigate every report we receive and will acknowledge your report and keep you updated as we work on it.

Please don't access or modify other users' data, run automated scanners against production without checking with us first, or publicly disclose an issue before we've had a reasonable chance to address it.

An honest note on where we are

usort is an early-stage product. We don't hold formal certifications like SOC 2 or ISO 27001 today, and we'd rather tell you that plainly than imply otherwise. Security is an ongoing investment for us, not a one-time checklist, and this page will be updated as our practices mature.

Contact

Questions about our security practices, or a report to make? Email support@usort.xyz.