Security

What this page covers

This page describes the public ProofGrit website and the current accounts, lab workspace and master records. Report workflows, audit trails and billing remain future features; we do not claim those protections before they exist.

Encrypted connections

The production site is served over HTTPS, so pages and form submissions travel encrypted between your browser and our servers.

Calculators run in your browser

The free calculators do their math on your device. The values you type into a calculator are not sent to our servers and are not stored by us.

The contact form

• Input is validated on the server before it is accepted.
• A hidden honeypot field helps filter automated spam.
• We use what you send only to reply to you.

Accounts and lab access

Passwords are hashed by Better Auth. Email verification is required, password-reset links are one-time, and resetting a password revokes existing sessions. Authentication requests are rate-limited. Server-side membership and role checks scope lab records and logos to the active lab; database foreign keys also prevent cross-lab relationships.

Sign-in links

• Sign-in links work once and expire after 15 minutes.

Configuration and secrets

Credentials such as database connection strings and API keys are read from environment variables on the server. They are not committed to source control and are not included in the code sent to your browser.

Payments

ProofGrit does not collect or store card numbers. When subscriptions are sold, payments are handled by Paddle.com as our Merchant of Record.

Reporting a problem

If you believe you have found a security issue, please contact us at support@proofgrit.com with enough detail to reproduce it. Please do not access data that is not yours.