Security

How Darklock protects your data

A security product has to hold itself to the standard it enforces. Here's how we build, run and monitor Darklock.

Encryption

All data transmitted to and from Darklock is encrypted using industry-standard protocols:

Transport encryption — all web traffic served over HTTPS/TLS
Data at rest — database encryption using industry standards
Password security — passwords hashed with salt, never stored in plain text
Session management — secure token-based authentication

Authentication and access control

Two-factor authentication (2FA) — optional TOTP support on accounts
Session management — automatic timeout and revocation
Role-based access control — granular dashboard permissions
IP whitelisting — restrict access by location (Pro)
API key management — scoped, revocable API tokens

Threat protection

Rate limiting — blunts brute-force attempts
DDoS mitigation — traffic fronted by Cloudflare
SQL injection prevention — parameterized queries throughout
XSS protection — Content Security Policy headers
CSRF tokens — on state-changing requests
Security headers — HSTS, X-Frame-Options, CSP

Monitoring and logging

Real-time alerts — suspicious activity detection
Audit logs — complete activity history
Anomaly detection — rule-based threat detection
Uptime monitoring — see the status page for live availability

Standards and practices

Darklock is built to align with recognized standards:

GDPR — EU data-protection principles; see the privacy policy for your rights
CCPA — California privacy rights
OWASP Top 10 — defenses against the most common web vulnerabilities

Vulnerability disclosure

Found a security issue? Report it privately to [email protected] or through the bug report form using the "Security Vulnerability" type. Please don't disclose publicly until we've had a chance to fix it.

Our disclosure process:

Acknowledgement — we review every report and reply as quickly as we can
Coordinated disclosure — we ask for up to 90 days to remediate before public disclosure
Credit — researchers who report responsibly are credited, with permission

Keeping your own account secure

Enable two-factor authentication on your account
Use a strong, unique password
Never share API keys or session tokens
Review your security logs regularly
Keep recovery codes somewhere safe
Log out from shared or public devices