Security
This is what the site does today to protect your account and data. We only say what we can verify, and below is what we do not have yet.
What we do today
Encrypted connection
The whole site is served over HTTPS and we tell your browser not to use any other connection (HSTS) (Privacy Policy, section 46).
Sessions
Your session is identified by a random code of which we only store a fingerprint, not the code itself. The cookie is HttpOnly, Secure and SameSite Lax, and its __Host- prefix stops any other subdomain from setting or overwriting it. You can close all your sessions from Security in your dashboard (Privacy Policy, section 10).
Passwords
They are stored with PBKDF2 and a different random salt for each password, never in plain text. New passwords must have at least 10 characters (Privacy Policy, section 10).
Browser protection
Every response carries a content security policy with a unique code (nonce): only the scripts the store marked with that code run. The site also cannot be embedded inside another page.
Payments with Stripe
Your card number does not go through our servers and is not kept in our database (Privacy Policy, section 26).
Each company sees only its own data
The company a piece of data belongs to is taken from your session, never from what the browser sends. One company cannot read another's data through the service (Privacy Policy, section 10).
Weekly backups
We make a full backup of the database every week, in separate private storage. They overwrite themselves within 35 days at most (Privacy Policy, section 9).
Internal access
The internal admin panel sits behind Cloudflare Access and a key of its own, and administrative access is recorded in an audit log (Privacy Policy, section 10).
Bot verification
The sign-up, contact and password recovery forms, and login after several failed attempts, use Cloudflare Turnstile verification (Privacy Policy, section 25).
Your data, under your control
The account owner can download their quotes and purchases (CSV) or everything as one JSON file, and can delete the account from Security in their dashboard. Data is permanently deleted after 30 days; only the payment record is kept (Privacy Policy, section 9).
Privacy Policy →Data processing →Terms →
What we tell you if there is an incident: Privacy Policy, section 36.
Report a vulnerability
If you found a security problem, write to us at soporte@ismiro.com with what you found, where, and how to reproduce it. We ask you not to share the details publicly until we have reviewed it.
What we do not have yet
- Security certifications: we do not have SOC 2 or ISO 27001.
- Two-step verification of our own: accounts log in with a password or with Google.
- A service status page: we do not have one yet.
- Storage encryption of our own: we rely on the encryption of our cloud infrastructure provider (Privacy Policy, section 46).