Security

Protect what matters.
Transparently.

You trust us with your infrastructure. Here is exactly how we protect your account and data — without the marketing gloss.

01 / How we protect you

Real controls. In the code today.

Encryption

  • Stored credentials and API keys encrypted with AES-256-GCM
  • TLS 1.3 for traffic to securecheap.com
  • Passwords hashed with bcrypt — never stored or logged in plain text

Account protection

  • Signed, expiring session tokens verified on every request
  • Password-reset links are single-use; only a SHA-256 hash is stored
  • Rate limiting on sign-in, reset and contact endpoints

Access control

  • Four team roles: Viewer, Editor, Admin, Owner
  • Each workspace’s data is scoped to its team
  • Administrative actions are written to an audit log

Application hardening

  • Security headers set on every API response (Helmet)
  • User content escaped in emails and pages
  • Dependency vulnerabilities audited and patched

Your data

  • Request a copy of your data at any time
  • Request deletion of your account and workspace data
  • We never sell customer data

Transparency

  • Live platform status at /status
  • Monitoring alerts for your own resources by email and Telegram
  • security.txt published for researchers

02 / Responsible disclosure

Found a vulnerability?
Tell us.

If you find a security issue, email [email protected] with steps to reproduce. We will acknowledge your report and keep you updated until it is resolved.

  • Test only against your own account and never affect other users
  • Give us reasonable time to fix before public disclosure
  • We commit to handling good-faith reports in good faith
Report a vulnerability
# /.well-known/security.txt
Contact: mailto:[email protected]
Preferred-Languages: en, ar
Policy: https://securecheap.com/security
View file

Questions?

Need more detail?
Talk to us.

We answer security and privacy questions for customers and buyers.

Email security Platform status