How we protect the platform
| Area | Measure |
|---|---|
| Connection | The whole website and platform run on HTTPS (TLS) only, with HSTS enabled. |
| Passwords | Stored with strong hashing (bcrypt). We never see them or send them by email. |
| Sessions and forms | Secure session cookies (HttpOnly, Secure, SameSite) and cross-site request forgery (CSRF) protection. |
| Abuse and spam | Per-address rate limits, anti-automation tokens, request origin checks and content filters on every form. |
| Payments | Processed by Stripe, certified PCI DSS Level 1. Card details never pass through our servers. |
| Webhooks | Payment notifications are only accepted with a valid Stripe cryptographic signature. |
| Secrets | Service keys and passwords are kept out of the code and out of the repository, on the server only. |
| Internal access | Administration requires a personal account, and access to customer data is limited to those who need it for support. |
| Headers | Browser security headers: protection against framing (clickjacking) and MIME sniffing, and a strict referrer policy. |
| Hosting | Servers in the European Union, with automatic backups from the hosting provider. |
Development
- Version-controlled code, with a history of every change.
- Automated tests of the main flows before every release.
- Internal folders (libraries, configuration, scheduled tasks and data) blocked from public access.
Responsible disclosure
If you find a vulnerability, email hello@neuralranks.com with the subject “Security” and the steps to reproduce it. Please don’t access other customers’ data, don’t degrade the service and give us reasonable time to fix it before disclosure. We won’t take legal action against anyone acting in good faith within these rules. The contact is also published at /.well-known/security.txt.
Incidents
If an incident affects your data, we’ll email you explaining what happened, what we did and what we recommend. See also the GDPR page.
Questions about this document? Write to hello@neuralranks.com.