Security

How we protect your data

• HTTPS everywhere, with strict transport security and a restrictive content security policy.
• Data encrypted at rest by our database host. Passwords hashed with bcrypt.
• Every query is scoped to the signed-in user. No page or API accepts a user or athlete id from the browser.
• Device connections need both a signed message from Terra and the same browser session that started them, and expire after 20 minutes. A connect link forwarded to someone else does nothing.
• Webhooks are verified with HMAC-SHA256 signatures and rejected if older than five minutes.
• Sign-in and sign-up are rate-limited; failed attempts take the same time whether or not the account exists.
• API keys and secrets live only in server environment variables, never in the browser or the code.
• Security-relevant events are logged, without health data, so incidents can be investigated.

Reporting a vulnerability

If you find a security problem, email privacy@paceva.app with the details and steps to reproduce. Please give us a reasonable time to fix it before disclosing it publicly. We won't pursue legal action against good-faith research that follows these rules:

• Only test against your own account and data.
• Don't access, change or delete anyone else's data. If you reach it by accident, stop and tell us.
• No denial-of-service, spam, social engineering or physical attacks.