Security

How the service is protected

All traffic is encrypted with TLS, and browsers are told never to connect over plain HTTP. Passwords are stored as bcrypt hashes, verification codes as keyed hashes.

Access is enforced on the server for every request: each organization's data is isolated from every other's, and deactivating an account ends its access immediately.

Login attempts, verification codes and automated scoring are rate-limited, uploads are validated and re-encoded, and significant actions are recorded in an audit log. The database is backed up nightly, encrypted.

Reporting a vulnerability

Email security@ballistiic.com with a description and steps to reproduce. Please give us reasonable time to fix an issue before disclosing it, and do not access other people's data, degrade the service, or run automated scanning against production while investigating.

We will acknowledge your report and keep you informed as we work on it.