Security
How we keep your data and orders safe.
Last updated: 2026-08-28
Transport encryption
All traffic between your device and our servers is protected with TLS 1.3 and HSTS.
Strong authentication
Passwords are stored as Argon2id hashes. Two-factor authentication is required for every staff account, and each privileged action needs a fresh second factor on top of being signed in.
Data at rest
Two-factor secrets are encrypted at rest with AES-256-GCM and versioned keys. Field-level encryption of further columns is being rolled out; it is not applied to every column yet.
Infrastructure
Servers are hosted in the EU (Germany).
Auditing
Every back-office action is logged with the actor, the target and the timestamp. The log is append-only and hash-chained: the database refuses updates and deletions outright, so a tampered entry is detectable rather than merely discouraged.
Vulnerability management
A documented vulnerability-management programme — dependency scanning, a regular patch cycle, external penetration testing — is on our roadmap and not yet in place.
Operational security
Access to production systems is restricted to a small number of engineers, authenticated with SSH keys. We're formalising a regular access-review process.
Incident response
We follow a documented incident-response plan with the following steps:
- Detect — automated alerting on anomalous events.
- Contain — isolate affected systems within 30 minutes.
- Notify — affected users and the data-protection authority within 72 hours where legally required.
- Recover and document — a post-mortem is published within two weeks.
Responsible disclosure
Found a vulnerability? Please contact us before publishing — we'll respond within 48 hours and credit security researchers in our hall of fame.
security@courierset.com — PGP key on request.
Status
We don't yet run a public status page or publish planned-maintenance notices. If something looks wrong, please contact us.