Security

Last updated: July 2025

ChartPlay takes the security and privacy of your data seriously. This page describes our security principles and the measures we implement to protect your information. Security is an ongoing process — we continuously review and improve our practices to adapt to evolving threats. If you discover a security issue, please report it responsibly using the contact information below.

Encryption

Data in Transit

All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security). We enforce HTTPS across all pages and API endpoints, and HTTP connections are automatically redirected to HTTPS. Deprecated protocols and ciphers are disabled.

Data at Rest

Sensitive data stored on our servers is encrypted using industry-standard encryption algorithms. Database backups are encrypted and stored in access-controlled locations.

Password Hashing

ChartPlay uses bcrypt for password hashing, a computationally expensive, adaptive hash function designed to resist brute-force and rainbow table attacks.

  • Each password is salted with a unique, cryptographically random salt
  • The cost factor is configured to provide strong protection against brute-force attacks
  • Passwords are never stored in plain text or transmitted in readable form
  • We support Google OAuth as an alternative, allowing users to avoid password storage entirely

Authentication

We implement multiple layers of authentication security:

  • Rate limiting: Login attempts are rate-limited per IP address and per account to mitigate brute-force attacks
  • Account lockout: Accounts are temporarily locked after multiple failed login attempts
  • Password requirements: Minimum 8 characters with complexity requirements
  • CSRF protection: State-changing requests require CSRF tokens where applicable
  • OAuth 2.0: Google OAuth is implemented following OAuth 2.0 best practices

Session Security

We protect user sessions throughout their lifecycle:

  • Authentication tokens are cryptographically random and generated server-side
  • OAuth flow parameters are transmitted over HTTPS and stored in secure, HttpOnly cookies
  • Tokens and sessions are transmitted only over HTTPS
  • Users can log out or delete their account to invalidate their authentication token

Infrastructure Security

Our infrastructure is built with security in mind:

  • Network security: Firewalls and DDoS protection are in place
  • Access control: Access to production systems is restricted to authorized personnel
  • Monitoring: Automated monitoring alerts us to suspicious activity and potential incidents
  • Backups: Encrypted backups are maintained with tested restoration procedures
  • Patch management: We apply security updates and monitor dependencies for vulnerabilities

Privacy-First Approach

Security and privacy are fundamental to ChartPlay's design:

  • We collect only the minimum data necessary to provide the service
  • We never sell your personal data
  • You can delete your account and associated data at any time
  • We are transparent about what data we collect and why (see our Privacy Policy)

Responsible Disclosure

ChartPlay welcomes responsible security research. If you discover a security vulnerability, we ask that you:

  1. Report it privately to [email protected]
  2. Provide sufficient details to reproduce the issue
  3. Allow us reasonable time to investigate and address the issue before public disclosure
  4. Act in good faith to avoid privacy violations, data destruction, or service disruption

We commit to:

  • Acknowledging your report promptly
  • Working with you to understand and validate the issue
  • Keeping you informed of our progress
  • Recognizing your contribution (with your permission) once the issue is resolved

Contact & Reporting

To report a security vulnerability or ask a security-related question:

For more information about how we handle your data, see our Privacy Policy and Terms of Use.