How we protect your account, your data and our platform.
Passwords are hashed with Argon2id (a memory-hard algorithm) and never stored or logged in plain text. Repeated failed sign-ins are rate-limited and temporarily lock the account. Optional time-based two-factor authentication (TOTP) with one-time recovery codes is available on every plan.
Sign-in sessions use random, server-side tokens in HttpOnly, Secure, SameSite cookies. You can see where you're signed in and sign out other devices from Account → Security. Changing or resetting your password signs out every other session.
Every record is stored with its workspace identifier and every read and write is checked against your signed-in membership. Roles control who can invite, remove members and manage billing.
All traffic is served over HTTPS with HSTS. Our database runs on a private network that is not exposed to the public internet.
A strict Content Security Policy, anti-framing headers, cross-site request forgery tokens, origin checks, input validation and size limits, and parameterized database queries protect against common web attacks.
Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card numbers go directly to Stripe and never touch HazardHarbor servers. Webhooks are verified with Stripe signatures.
HazardHarbor's original content, design and software are protected by copyright and our Terms. Automated scraping, framing and redistribution are prohibited and rate-limited.
Export your data at any time in open formats (JSON and CSV). Delete your account and workspace permanently from Account → Data & privacy.