Draft pending review. This page describes the controls this application ships with. It is not a certification.

Security

RegMemo Intelligence stores passwords with bcrypt. Sessions are random tokens stored only as a hash, in an HttpOnly cookie. Production on app.regmemo.com refuses to start with the default session secret or with the demonstration administrator switched on.

Card data is collected by Stripe, not by this application. Development checkout, used when Stripe is not configured, does not ask for a card number.

Webhooks are verified with the Stripe signing secret. Form posts are rejected when the browser origin does not match the host.

Reporting a vulnerability

Email the security address configured for this install (security@regmemo.com unless the operator has changed it). Include the steps to reproduce the issue. Please give us a chance to fix it before publishing details.

Availability credits

If an outage lasts more than 24 consecutive hours, or monthly availability falls below 99.5%, a service credit is applied to current subscriptions. An administrator records the outage; the credit is calculated and applied without a coupon code.