Security, in plain words

Accounts

• Passwords are hashed with scrypt and a unique salt. We cannot read them.
• Sessions use a random token in an HttpOnly cookie; only a hash of it is stored.
• Email verification and password reset links are single-use and expire.
• Repeated sign-in attempts are rate limited.
• Clients and studio staff have separate roles. A client account cannot open the sales desk.

Payments

Card payments happen on Stripe Checkout. Card numbers never reach our servers and are never stored by us. Webhooks from Stripe are verified by signature. Bank transfer details are shown only when they are configured; they are never guessed.

Files

Briefs, logos, images and ticket files are stored privately and served only to the account that owns the project and to studio staff. File types and sizes are checked on upload.

Fetching your site

Health checks and the public research step fetch your site from our server. Private and internal network addresses are refused. Research reads only the page title and description.

Third parties

Stripe, for card payments. Your email provider, for sending mail. Nothing else. If visit counting is switched on, it runs on our own server (Umami, cookie-free). See privacy and cookies.

Reporting a problem

Found a vulnerability? Write to hello@bytyn.com with “Security” in the subject. We reply within two business days and do not take action against good-faith reports.