Legal
Security
Last updated:
Controls that exist, not intentions
Everything below is implemented in NOIZ today. Claims that stopped being true have been removed from this page rather than reworded, and the date at the bottom is the last time it was checked line by line against the code.
Two-factor
Optional TOTP, with backup codes
Database
Row Level Security on all tables
Transport
Encrypted (TLS/SSL)
Sign-in
Rate limited
Found something? Report it privately and we will look at it.
security@noiz.bioAuthentication Security
How signing in is protected
- Rate limiting on login attempts
- Optional two-factor authentication (TOTP), with single-use backup codes
- Secure session management with JWT tokens
- Password strength requirements
- Secure password reset via email verification
Data Protection
Who can read your data, and how long it is kept
- Row Level Security (RLS) policies on all tables
- User data isolation - access only your own data
- Encrypted data transmission (TLS/SSL)
- GDPR-compliant data retention policies
- IP addresses deleted within 30 days - abuse-limiter digests within 7
Infrastructure Security
What happens to a request before it reaches your data
- Secure API endpoints with proper validation
- Input sanitization and validation
- JWT verification on protected routes
- File type and size limits enforced on the server, not just in the browser
- URL construction safety measures
Monitoring & Transparency
What is logged, what is published, and where to look
- Login attempt logging, reviewable in the admin panel
- Public status page, with uptime measured from outside our own infrastructure
- The date of the last security review, published below
- A published contact for reporting a vulnerability
Three more things worth knowing
Access Control
Two separate things: every row is fenced to the account that owns it by the database itself, and the admin surfaces are gated on an explicit role that almost no account has.
Dependencies
The dependency tree is audited for known vulnerabilities, and every deploy is a fresh build from a pinned lockfile.
Deleted files
Removing an image deletes the stored object and purges the CDN copy. Without that second step a cached file stays fetchable at its old address for a year.
Who runs this
Noiz is built and operated by one person. Every control listed above is implemented in the product rather than promised in a policy, and when a review finds something wrong we say so on this page instead of quietly fixing the wording. The date below is the last time this page was checked against what the code actually does.
Found a vulnerability?
Mail security@noiz.bio with the URL, what you did and what happened — enough to reproduce it. It reaches a person, not a queue, and there is no bounty programme to apply to first. If it is your own account that has been compromised rather than a flaw in the product, write to support instead and change your password before you do.
Email security@noiz.bio