Our approach
We design the service to collect only the data it needs, limit who can reach it, and reduce the impact when something goes wrong. Security is reviewed as part of building and changing the product.
Infrastructure
Connections to the service are protected with TLS. The final version of this policy will describe our hosting and environment setup in more detail.
Our crawler uses a fixed, published identity so site owners can recognize and verify its requests.
Access control
Data is scoped to workspaces, and role checks are applied on every request, so members only see and change what their role allows. Passwords are hashed with Argon2, sessions use HTTP-only cookies, and authentication endpoints are rate limited. Workspace Owners and Admins can see an audit log of important actions.
Encryption
Data is encrypted in transit using TLS. The final version of this policy will describe our encryption at rest practices in detail.
Monitoring and backups
The final version of this policy will describe our monitoring and backup practices in detail.
Responsible disclosure
If you find a vulnerability, please report it to hello@bigrank.si with enough detail to reproduce it. Give us reasonable time to fix it before sharing it publicly, and avoid accessing data that is not yours or disrupting the service.
We will acknowledge reports and keep you informed as we investigate.
Contact
Security questions can be sent to hello@bigrank.si.