Security

Passwords are protected with Argon2id and are never stored in plain text. Session refresh tokens are stored as hashes, so they cannot be directly reused if the database is accessed without authorisation.

Session tokens are transmitted through HttpOnly cookies; in production, the Secure and SameSite attributes are also applied. Sessions have a limited lifetime and can be invalidated after logout or a credential change.

Time-based one-time password (TOTP) multi-factor authentication is available for accounts, together with single-use recovery codes. Failed attempts are limited and may temporarily lock access.

Incoming requests are validated and unexpected fields are rejected. We apply rate limits to sensitive operations and depth and alias limits to GraphQL queries to reduce abuse and abnormal resource consumption.

In production, we use HTTPS and security headers including HSTS, frame protection, content-type controls, a Content Security Policy and a restrictive referrer policy.

Project attachments are not exposed as public files: access requires authorisation as the resource owner or an administrator. Uploaded content is served with rules designed to reduce the risk of execution in the browser.

Access to client-area features and data is controlled according to identity, role and resource ownership. Sensitive authentication activity may be logged to identify unusual attempts, prevent abuse and support security investigations.

We collect only the technical data needed for security purposes and retain it for proportionate periods, as described in the Privacy Policy.

Any online payments are processed by Stripe. FMDigitech does not store complete payment-card details. Selected third parties may provide infrastructure and traffic-protection components, as described in the Privacy Policy.

We assess security reports and events to contain their effects, address the cause and restore the service. When an incident involves a personal data breach, we follow the assessment, documentation and notification procedures required by Articles 33 and 34 of the GDPR.

If you believe you have found a vulnerability, email [email protected] with the affected service, steps to reproduce the issue, the expected impact and, where available, technical evidence that excludes unnecessary personal data.

While testing, do not access other people's data, modify or delete information, disrupt the service, or use social engineering, phishing, denial-of-service techniques or high-volume scanning. Please allow us reasonable time to investigate and address the issue before public disclosure.

Use a long, unique password, enable MFA, keep recovery codes in a safe place and never share credentials or verification codes. Sign out of shared devices and contact us immediately if you notice logins, emails or activity you do not recognise.