Security
Last updated 2 November 2026
Your plans, comments and timesheets are your team's business. Here's how we protect them, and how you can help.
How we protect your data
- Encryption: HTTPS everywhere, with HSTS. The database and backups are encrypted at rest.
- Passwords: stored with Argon2id, a slow one-way hash. New passwords are checked against known breaches with a method that never sends the password itself.
- Sign-in protection: email verification, rate limits and lockouts that grow after repeated failures, and an email whenever a new device signs in.
- Access control: every request checks that you're a member of the Space and that your role allows the action. Spaces you aren't in look like they don't exist.
- Browser protections: a strict content security policy, no third-party scripts, and protection against cross-site requests.
- Audit trail: changes to issues are recorded with who made them, and security events such as exports and role changes are logged.
- Backups: daily, and we test restoring them.
How you can help
- Use a long, unique password, or sign in with Google or Apple.
- Give people the smallest role they need: Viewers can look but not change anything.
- Use "Sign out everywhere" in Settings → Security if you lose a device.
Reporting a problem
Found a security issue? Email security@fintrekking.com. We reply within two working days and won't take action against good-faith research.