Security

In transit

• Every page and API is served over HTTPS. Plain http is sent to https in one step.
• HSTS is on for one year, including subdomains.
• Pages carry a strict Content Security Policy with a new nonce for every response, and cannot be framed by other sites.

Accounts

• Passwords are hashed with PBKDF2. New passwords are checked against known breaches with Have I Been Pwned, which only ever sees part of a hash.
• Session tokens are stored only as SHA-256 hashes. The cookie is HttpOnly, Secure and SameSite=Lax.
• Every form is protected against cross-site request forgery.
• Sign-in, sign-up and password reset are rate limited.
• Two-step sign-in with an authenticator app is there for every account, and required for our admins. Its key is encrypted at rest, each code works once, and wrong codes are rate limited.
• Settings, Security lists every signed-in browser with its device, rough country and last use, and signs out any one of them.
• An account owner can require two-step sign-in for everyone on their team. Until a teammate turns it on, they can only set it up, sign out or leave.
• On Agency and Custom, an account owner can connect their company's identity provider with OpenID Connect, so the team signs in with their company account. Each email domain is proved with a DNS record first. The client secret is encrypted, and each ID token's signature, issuer, audience, expiry and one-time nonce are checked. The owner can require it for a domain; their own password plus two-step sign-in still works, so a provider outage never locks them out. SAML and SCIM are not offered.
• Settings, Activity shows the account's owner and admins who changed the team, sites, keys, connections and the plan, with the time and the city and country. Each person also sees their own sign-ins there. It keeps 90 days on paid plans and shows 7 on Free. With each line we keep only the network part of the IP address, never the whole address.
• Security changes, like turning off two-step sign-in or changing your email, ask you to confirm it is you first. We email you about each one, and about a sign-in from a new browser.
• Client invites need no password: the email holds a one-time sign-in link that lasts 7 days, and access ends the moment you remove it.

Keys and tokens

• The tokens and keys of every tool you connect (ad platforms, stores, CRMs and email tools) are encrypted before they are stored, with a key kept as a Cloudflare secret.
• Our own API keys live in Cloudflare secrets, never in code.
• Each site's Events API key can be replaced at any time, and the old one stops working.

Short links

• Only signed-in users with a confirmed email can make links.
• Every destination is checked with Google Safe Browsing and against a list of other shorteners, and checked again at least daily.
• Link creation is rate limited per account.
• The short link host only redirects. It never serves pages, files or a sign-in form, and the destination always comes from our database, never from the request.
• We can turn off any link or account that is misused.

Visitor data

• Visitor IP addresses are never stored.
• The salt behind visitor hashes is replaced daily and the old one deleted.
• Emails and phone numbers are matched as SHA-256 hashes. Customer profiles keep them in plain form only encrypted (AES-GCM, bound to the site), and only while the site owner shows contact details.

Where it runs

Datacenter runs on Cloudflare Workers, with data in Cloudflare D1 and Workers Analytics Engine. Payments are handled by Stripe. What we keep, for how long, and how it is backed up is on Data, retention and backups. Whether it is all working right now is on the status page. Status, documents and the companies that help us run Datacenter are together on the trust page.

Report a problem

If you find a security issue, email hello@datacenter.so. Please give us time to fix it before you share it. We will reply, keep you posted and thank you. By post: Datacenter LLC, 5142 N Academy Blvd PMB 1021, Colorado Springs, CO 80918, United States. Our contact details are also in security.txt.