معلومات قانونية

Security

آخر تحديث: 21/10/2026

How Receivly protects your company’s data.

Isolation of each company

Every table holding business data is protected by PostgreSQL row-level security with a restricted database role: even a programming mistake in the application cannot return another company’s rows. This is covered by automated tests.

Accounts

Passwords are hashed with scrypt; sign-in attempts are rate-limited; sessions use secure, HttpOnly, host-only cookies and are revoked when the password changes. Two-factor authentication (authenticator app with recovery codes) is available to every user. Social sign-in uses the providers’ official OAuth flow.

Application

HTTPS only with HSTS, strict content security policy (no inline scripts), CSRF tokens on every form, origin checks, signed cookies, and no third-party scripts or trackers.

Operations

Hosting on Vercel and Neon (managed PostgreSQL with point-in-time restore). Errors are logged with a reference that support can trace without exposing your data. Incidents and maintenance are announced in the app banner and on the status page.

Report a vulnerability

Please report security issues through the contact form (topic: legal) and do not access data that is not yours. We will acknowledge and fix confirmed issues quickly.