Security

This page describes security controls HULOFTON has currently implemented. It is not a certification, penetration-test report, or a guarantee against unauthorized access. No security control is absolute.

Account and authentication

• Sign-in via email/password or Google, managed by our authentication provider.
• Passwords are hashed by the authentication provider and are not stored in cleartext by HULOFTON.
• OAuth flows use short-lived tokens and same-origin redirect URIs.

Data

• Row-Level Security (RLS) is enabled on user-owned tables.
• User roles are stored in a dedicated table and checked server-side; roles never live on the profile object.
• Sensitive server keys and webhook signing secrets are stored as encrypted environment secrets, not in source code.
• Traffic to HULOFTON is served over HTTPS.

Payments

Payment card data is handled entirely by Stripe. HULOFTON never receives full card numbers or CVV. Stripe webhooks are verified with Stripe's signature scheme; duplicate webhook events are ignored idempotently.

Storage

Uploaded files are stored in access-controlled storage buckets. HULOFTON does not currently perform automated virus scanning, EXIF/GPS stripping, or content-integrity validation of user-uploaded files.

AI

AI requests are proxied through a rate-limited, per-user server gateway. See AI Disclaimer.

What we do not claim

• HULOFTON is not certified by any independent security auditor.
• HULOFTON has not undergone third-party penetration testing.
• No system can guarantee prevention of unauthorized access or complete deletion of data from every backup, log, or downstream system.

Report a vulnerability

Please contact us through Support with "security" in the subject. Do not publicly disclose issues before we have had a reasonable chance to fix them.