Security
Some of the measures we take to protect your account and data. No system is completely immune — we keep improving these layers as the product grows.
Hashed passwords
Passwords are always stored via a one-way hash (Argon2id) — never as plain text, and not recoverable even by us.
Token-based authentication
Account access is managed with short-lived access tokens and opaque refresh tokens, with reuse detection and family-wide revocation on suspected compromise.
Server-side authorization
Every action is checked against your permissions on the server — not just in the screen — to prevent access to data or actions that aren't yours.
Input validation
Every request is validated and sanitized server-side, including protection against code injection and malicious content, before it touches the database.
Rate limiting
Sensitive endpoints — login, sign-up, verification codes — are rate-limited to reduce brute-force and password-guessing attempts.
Infrastructure hardening
Standard security headers, a CORS allowlist, and request/image size limits are enforced at the infrastructure level.
Image validation
Uploaded files are checked against their actual content, not just the file extension, with size and count limits.
Admin audit logging
Sensitive actions in the admin panel — viewing personal data, suspensions, enforcement — are recorded in an append-only audit log.
Reporting a security vulnerability
If you find a security weakness in Clanio, we'd appreciate a responsible report before any public disclosure. Email legal@clanio.co with a detailed description and reproduction steps where possible. Please avoid accessing other users' data, denial-of-service testing, and modifying or deleting data during your testing. We're a small team and will get back to you as soon as we can — a dedicated security-report channel is still in progress.
This page describes security principles already implemented in the product. For details on how personal data is collected and retained, see our Privacy Policy.