What protects your account, named specifically enough that you can hold us to
it — and, at the end, what we deliberately do not claim.
Getting your data here
Every connection between your device and ClapDiet is over HTTPS. The servers
send a strict-transport-security header with a one-year lifetime covering every
subdomain, which tells your browser to refuse a plain-HTTP connection to
ClapDiet even if something tries to downgrade one.
The web app also ships a content security policy: scripts and styles load from
ClapDiet itself, plugins and framing are switched off entirely, and form
submissions can only go back to ClapDiet. That is the defence against a
script injected into a page trying to send your data somewhere else.
Getting into your account
Your password is never stored. What is stored is a bcrypt hash of it. Thatis a one-way function with a deliberate work factor: it cannot be reversed, and
it is slow enough that guessing through a stolen table of hashes is expensive
rather than instant.
Failed sign-ins lock the account, progressively. Three failures locks itfor five minutes, five for fifteen minutes, ten for an hour, and twenty for a
full day. The ladder is why an attacker working through a password list gets
four attempts an hour rather than thousands.
Two-factor authentication is available and optional. It uses TOTP, thesix-digit rolling code any authenticator app produces, and it comes with
single-use backup codes. The backup codes are bcrypt-hashed too, so the list
stored on our side is not a list of usable codes.
Requests are rate limited — three ceilings run at once on every endpoint,over one second, ten seconds and a minute, with tighter ones on the paths worth
abusing.
Writes carry a CSRF check. Because the browser session rides in cookies,a request arriving from another site with your cookies attached is rejected.
Who touched what
Two independent trails record access.
The application writes audit rows for sign-ins, failed sign-ins, password
changes, deletions and administrator actions. Separately, database triggers
record changes to accounts, sessions, OAuth links, lab panels and
subscriptions — a layer beneath the application, so it records a change even
if the change did not come through the application.
Both are kept 90 days and purged nightly. Expired sessions are cleared on
their own nightly pass.
The third parties, and exactly what each gets
Stripe handles payments. Card details are entered on Stripe's own checkoutpage and never reach ClapDiet — there is no card number field anywhere in this
product, which is the strongest form that promise takes.
Google Gemini is the AI. When a feature asks it something on your behalf,it receives the health facts the answer needs: your date of birth, biological
sex, height and weight, your conditions with their severity and diagnosis
dates, your medications with dose and frequency, your allergies, your
preferences, and your most recent lab panel. It does not receive your name
or your email address. That is a real limit and it is not the same thing as
anonymity — health facts about one person are identifying in aggregate, and we
would rather say so than call it anonymised.
Sentry receives errors from the website so we can fix crashes. The phoneapp sends nothing to any monitoring service; it has no analytics SDK and no
crash reporter.
Object storage holds the lab documents you upload. Deleting a lab panel, oryour account, deletes the file behind it.
What we do not do
find you.
What we do not claim
A security page is only worth reading if the absences are in it too.
The database itself is not separately encrypted, and telling you otherwise
would be the easiest sentence to write and the least true.
penetration test.
physical data-centre controls we cannot show you.
If any of that changes, this article changes with it, and it will name the
thing rather than the impression.
Your part
than your phone.
Reporting a security problem
Email security@clapdiet.com. Tell us what you found and how to reproduce
it. We would much rather hear it from you first.
Related Articles: