Security

Last updated: August 2025

DeedMine takes the security of your data and API access seriously. This page describes our security controls and how to report vulnerabilities.

Authentication

  • Passwords are hashed using bcrypt at cost-12 — never stored in plaintext.
  • API keys are generated with cryptographically secure randomness (Python secrets), prefixed with dse-, and stored as SHA-256 hashes. Raw keys are shown once at creation and cannot be recovered.
  • Session cookies are scoped to the origin and use SameSite=Lax.
  • Brute-force protection: accounts lock for 15 minutes after 5 failed login attempts, and for 1 hour after 10 failed attempts (HTTP 423).

Password Policy

All passwords must be at least 12 characters and include an uppercase letter, a number, and a special character. This is enforced server-side.

Data in Transit

All traffic between your browser/SDK and DeedMine is encrypted using TLS 1.2+. HTTP requests are redirected to HTTPS.

Data at Rest

  • Database is hosted on Railway with encrypted volumes.
  • Backups are encrypted and retained for 7 days.
  • No raw API keys, passwords, or payment card numbers are stored.

Rate Limiting

  • Signup: 5 requests / minute per IP
  • Login: 10 requests / minute per IP
  • Scoring endpoints: per-plan quota enforced monthly; 60 requests/minute per API key by default
  • CSV upload: 20 MB maximum

Rate limits are enforced via Redis-backed middleware.

Access Control

  • All scoring and monitoring endpoints require a valid API key.
  • Metrics and admin endpoints require an admin-role key.
  • Multi-tenant isolation: each organization can only access its own data.

Infrastructure

  • API / backend: Railway (isolated container, no shared compute)
  • Frontend: Vercel Edge Network
  • Payments: Stripe (PCI DSS Level 1 certified)
  • Email: Resend / SendGrid (SPF, DKIM, DMARC configured)

Responsible Disclosure

If you discover a security vulnerability, please email security@deedmine.com. We ask that you:

  • Not publicly disclose the issue until we have had 90 days to address it
  • Not access or modify data belonging to other users
  • Not perform denial-of-service testing

We will acknowledge receipt within 48 hours and keep you updated on our progress.

Contact

Security concerns: security@deedmine.com
General privacy: privacy@deedmine.com