Security

Access control

Staff accounts are created by an administrator only. There is no public registration. Passwords are stored as salted scrypt hashes, sessions are HTTP-only cookies and every administrative write is recorded with the responsible account.

Data boundary

Neziora Tools processes documents entirely in the browser. User files are never transmitted to our servers.

Infrastructure

Production deployments run on infrastructure we control, with HTTPS, a restrictive content security policy, regular patching and verified backups.

Reporting a vulnerability

If you believe you have found a security issue, write to [email protected] with reproduction steps. We acknowledge reports within two working days and will not pursue action against researchers acting in good faith.