Security and your data
The short version of how we protect your books, where they live, and how to get them back out.
Our baseline
- Passwords are stored as argon2id hashes and checked against lists of breached passwords.
- Sessions end after 7 days without use, and after 30 days in total.
- Staff access to the admin area sits behind an extra access check and needs a passkey or a one-time code.
- Each company's data is kept apart from every other company's, and the database enforces that rule.
Where your data lives
Your data is stored in the European Union. Backups are kept in the European Union too. The retention notice says how long we keep each kind of record.
Export
You can export your data at any time, including after you cancel. Export never stops working.
Report a problem
Found a security problem? Tell us, and give us time to fix it before you share it.
This page summarises our security baseline. The full text is reviewed before launch.