Security

How we protect your data

• HTTPS only — all traffic is encrypted in transit.
• Passwords — stored as bcrypt hashes. Never stored in plain text.
• Session cookies — HttpOnly, Secure, SameSite=Lax. Not accessible to JavaScript.
• Authentication tokens — signed JWTs with a secret of at least 256 bits, expiring after 24 hours.
• EU hosting — all servers and databases are located within the European Union.
• Automatic deletion — uploaded files and reports are deleted after 30 days.
• No tracking — no analytics scripts, no third-party trackers, no advertising SDKs.

Upload limits

To protect service availability, uploads are limited to 10 MB per file and 5 files per analysis run.

Reporting a vulnerability

If you discover a security issue, please report it responsibly via our contact page. We will acknowledge your report within 72 hours and work to resolve critical issues promptly.

Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them.

Scope of this document

This page describes security measures for the ExplainMyNumbers SaaS. The local runner (CLI) operates entirely on your own machine and is not covered here.