Security
How we keep your data safe.
This page lists what this website actually does to protect what you send it, and, just as important, what it does not do. Nothing here is a badge or a promise of perfection. It is a description of how the site is built.
What is in place
Encrypted in the database
Names, emails, project briefs, notes and similar fields are encrypted before they are stored, using AES-GCM with a key held outside the database. Each value is bound to its own row, so a stolen database file is unreadable without the keys. To look someone up by email I use a keyed hash, not the email itself.
Passwords are never stored
Passwords are run through a salted PBKDF2 hash with a secret server-side “pepper”. A password must be at least 12 characters and is checked against common-password lists and, privately, against known breaches (only a short hash prefix leaves our server). Wrong guesses are rate-limited per account and per connection.
Safe sessions
When you sign in, the session lives on the server and your browser holds a random identifier in a cookie that scripts cannot read (HttpOnly, Secure, SameSite=Strict). Sessions expire, rotate, and are replaced when you log in. You can see your devices and sign any of them out in Settings.
Two-step verification
You can turn on authenticator-app codes (standard TOTP) and get one-time recovery codes, which are stored only as hashes. Sensitive actions such as changing your password, changing 2FA or deleting your account ask for your password again.
Your account is yours alone
Every account request is tied to your server-side session, never to an ID sent from the browser, and every state-changing request needs a per-session anti-forgery token and a same-site origin. Other people’s data cannot be reached by changing a number in a URL.
Hardened against injection
Every database query uses bound parameters, and an automated test fails the build if any query is assembled from request data. All input is validated and size-limited. The pages use a strict content security policy with no inline scripts or styles, no third-party scripts, and no use of innerHTML.
Abuse controls
Forms use rate limits, a hidden honeypot field, short-lived signed form tickets and blocking of common scanning tools. An optional Cloudflare Turnstile bot check is built in and can be switched on if abuse appears.
Payments stay with Stripe
Card numbers are typed on Stripe’s page and never reach this site. We only keep the order reference, package and status.
Your data, your choice
You can download everything held about your account and delete the account for real from Settings. Unpaid requests are deleted, and requests that were never turned into an order are cleaned up automatically after 12 months. Details are on the privacy page.
No ad trackers
There are no analytics or advertising scripts. The only cookie is the sign-in session cookie, and it is only set if you sign in. Fonts are served from this site, so your browser makes no requests to font providers.
What is not in place (yet)
Being straight about limits is part of being trustworthy.
- WadeWeb is a one-person business. There is no formal certification (SOC 2, ISO 27001, PCI attestation, HIPAA) and no third-party penetration test of this site.
- The site owner can read decrypted data in the admin panel, because that is needed to do the work and reply to you. The encryption protects against database theft and leaks, not against the person running the business.
- Email-based password reset and email verification are not available yet, so accounts are not email-verified. If you lose both your password and your recovery codes, an account can only be recovered by contacting me, and I may not be able to prove it’s you.
- Because sign-up does not verify email, an attacker could try to deliberately lock a known email address out by guessing its password. Lockouts are temporary and your data stays safe, but it can be a nuisance.
- No system is unhackable. If something here is ever compromised, affected people will be told.
Found a problem?
If you think you have found a security issue, please tell me before telling anyone else. Email wadeweb@mail.grokbot.com (see also security.txt). Please don’t access other people’s data or disrupt the service while testing. I’ll reply as quickly as I can, and good-faith reports are welcome.