Security

This page lists only measures that run in the Service today. It is Annex II of the DPA.

Sign-in and sessions

• Passwordless sign-in. The emailed link works once and expires after 10 minutes. Opening it shows a confirm page, and only the button press on that page signs you in, so email security scanners that open links cannot use them up.
• Sign-in requests are rate-limited per email address, per address and network, and per network.
• Sessions live in an HttpOnly, Secure cookie for up to 14 days.

Your material

• Original deck files are not kept. They go straight from the browser to a private storage bucket with a one-time upload link, are deleted right after they are read, and unread uploads are deleted within 48 hours. Uploads must be a real PDF, PowerPoint (.pptx) or Markdown file (checked by file signature or text encoding before any tokens are spent) and at most 10 MB. From PowerPoint files only slide text and speaker notes are read, under fixed size caps.
• Material is private to your account. Every request that reads or changes a dossier or a reading checks that it belongs to you; row-level security is enabled on the database tables as a second layer.
• Share links are signed, so they cannot be guessed or altered. Password-protected shares use bcrypt, take the same time to answer whether a password is right or wrong, and remember an unlock only in a signed, expiring cookie.

Readings resist manipulation

• Submitted material is isolated and treated as data, never as instructions.
• A typed description or chat answer counts as a claim, never as a document.
• Model output is validated against strict schemas before anything is stored.
• Every new rating gets an independent quality check; disagreement lowers the confidence.
• The same evidence returns the stored reading, so resubmitting cannot fish for a better number. Readings are append-only.

Tokens and payments

• Balance changes are atomic; a failed reading is refunded exactly once.

Platform

• HTTPS only, with HSTS and a Content Security Policy.
• Secrets live only on the server. Secret comparisons run in constant time.
• Every change passes type checks, lint, more than 750 automated tests and a production build in CI before it can be merged; each production deploy is followed by an automated smoke test.
• Security reviews of the code took place in October 2026 (two passes); every high-severity finding was fixed before release.

Report a vulnerability

Email security@moatdefender.com. Please give us a reasonable time to fix the issue before you disclose it. Don't access other people's data, degrade the Service, or use social engineering while testing. We reply within 3 working days.