Security and privacy

Profile snapshots are encrypted with Fernet before they touch disk and are transferred only over TLS to an authenticated owner.

Staff cannot download a snapshot unless an admin records a reason. That action is written to the audit log.

Sessions use an HttpOnly cookie. Mutations from the browser must send the CSRF token. API keys and device tokens are bearer credentials and should stay out of page scripts.

Public forms ask Cloudflare Turnstile to verify a token on the server. Turnstile is not a substitute for rate limits or authorization.