Your data is encrypted, and access stays in your hands.
We only list what the system actually does, and say plainly what it doesn't.
- Google access tokens encrypted with a separate salt per record.
- AES-256-GCM
- All traffic encrypted; browsers never fall back to HTTP.
- TLS + HSTS
- Authenticator app + 10 single-use recovery codes.
- 2FA
- iyzico stores the card; our reference to it is encrypted too.
- No cards stored
01 · Connection
Infrastructure and traffic
Behind Cloudflare
The server accepts web traffic only from Cloudflare; direct access is closed.
HSTS and Content Security Policy
Browsers open the site only over HTTPS; scripts can't load from unapproved sources.
Request origin checks
Other sites can't send requests on your behalf (CSRF protection).
02 · Google
Access to your Google account
Official OAuth connection
We never see your Google password; you can revoke access from your Google account any time.
Tokens stored encrypted
Access and refresh tokens are kept encrypted with AES-256-GCM.
Deleting your account revokes Google access
During deletion, tokens are sent to Google to be revoked.
03 · Account
Sign-in and sessions
Two-factor authentication
Authenticator app codes plus 10 single-use recovery codes.
Attempt limits
5 sign-in attempts per minute per IP, 10 per 10 minutes per account.
Active sessions and security history
See every device and sign any of them out remotely. Passwords are stored with bcrypt.
04 · Team and support
Who can access what
Role-based permissions
Owner, admin, editor, viewer: everyone sees what they need.
Support access is logged
Support can enter your account only with a written reason and a 5-minute single-use grant; every entry is logged.
2FA required for staff
The admin panel can't be accessed without two-factor authentication.
05 · Your data
Backups, retention, deletion
Encrypted nightly backups
The database is encrypted and copied to separate storage every night; backups are kept for 30 days.
Records expire automatically
Sign-in records after 90 days, email logs 60, error logs 30. Full table in the Privacy Policy.
Export your data, delete your account
From Settings › My account. Deletion is immediate and can't be undone.
To be clear
We don't hold ISO 27001 or SOC 2 certification and haven't had an independent penetration test yet. When we do, we'll list it here with the date.
How your data is processed: Privacy Policy · KVKK Disclosure Notice
Found a vulnerability?
Email security@localghost.co with the steps and the affected URL; we reply within 3 business days. Please don't access other users' data, degrade the service, or disclose the issue before it's fixed.