Security

How EmiMine protects data

HTTPS only; strict Content Security Policy with no third-party scripts; passwords hashed with scrypt; optional two-factor sign-in; sessions that expire; CSRF protection on every form; API keys stored only as hashes; organisation isolation tested on every release; an audit log of every change.

Hosting

DigitalOcean App Platform with a managed PostgreSQL database, encrypted at rest, with daily backups.

Reporting a vulnerability

Please report suspected vulnerabilities through the contact page, choosing "Security". Do not access data that is not yours, and give us reasonable time to fix the issue before you disclose it. We will acknowledge your report within five working days.

Last updated 16 October 2026.