Security Overview

Updated on August 4, 2026. These policies are adapted from the Basecamp Open-Source Policies / CC BY 4.0

SenseFolksis a product research platform developed by Projckt, India. Protecting your account and research data is part of how we design and operate the service.

In short: we encrypt data in transit, hash passwords with Argon2, limit access, back up data regularly, and use several layers of application and infrastructure protection. The details are below.

Contents

• Authentication and access control
• Data protection
• Transport security
• Application security
• Infrastructure
• Billing and payment security
• Monitoring and incident response
• Law enforcement
• Data deletion
• Report an incident

Authentication and access control

User sessions are managed through session-based authentication backed by Redis.

Passwords are hashed using Argon2, a memory-hard algorithm designed to resist brute-force and GPU-based attacks.

We also support Google OAuth for users who prefer third-party authentication.

Sessions expire after a defined period of inactivity, and session tokens are invalidated on logout. No passwords are stored in plain text, ever.

Data protection

All data is stored in databases following best practices for performance and reliability.

Database backups run daily at regular intervals, and those backups are encrypted.

Files uploaded to the platform are stored via Cloudinary with access controls in place.

Transport security

All data in transit between you and us is encrypted over HTTPS. We enforce TLS for every connection.

Within our private networks, data transfers are encrypted as well.

Cloudflare sits in front of our infrastructure, providing an additional layer of DNS security and DDoS protection.

Application security

We apply multiple layers of protection at the application level:

• CSRF protection — Every state-changing request is validated with anti-CSRF tokens. This prevents malicious sites from making requests on your behalf.

• Rate limiting — API endpoints and authentication routes are rate-limited to prevent brute-force attacks and abuse.

• CORS policies — Cross-origin requests are restricted to approved domains only. Unauthorised origins are rejected.

• Content Security Policy (CSP) headers — We set strict CSP headers to prevent cross-site scripting (XSS) and other injection attacks by controlling which resources the browser is allowed to load.

• Bot protection — We use rate limiting and origin validation on sensitive flows at app.sensefolks.comto block automated abuse.

Infrastructure

SenseFolks runs on Hetzner cloud servers with Cloudflare providing CDN, DNS, and security services. Our software infrastructure is updated regularly with the latest security patches. The network is locked down with firewalls and carefully monitored.

Billing and payment security

SenseFolks is currently available on the Free plan only. There is no checkout, we do not collect payment details, and we do not store credit card information.

Paddle is listed as the planned payment provider, but payment processing is not active and no SenseFolks payment data is sent to Paddle. We will update this overview before paid upgrades launch.

Monitoring and incident response

We monitor our systems continuously to catch suspicious activity against our domains.

To date, we have never had a data breach. If someone does successfully mount an attack, we will immediately notify all affected customers.

We also audit internal data access. If a Projckt employee wrongly accesses customer data, they will face penalties ranging from termination to prosecution.

Law enforcement

Projckt does not disclose your data to law enforcement unless required by valid legal process. We reject requests that do not meet legal requirements.

Unless legally prohibited, we notify affected users when we receive such requests.

Data deletion

All your content becomes inaccessible immediately when you delete your account.

Within 30 days of account deletion, all your content will be permanently deleted from all servers and logs.

This information cannot be recovered once it has been permanently deleted. All data will be permanently deleted from backups within 60 days.

Report an incident

Noticed abuse, misuse, an exploit, or experienced an incident with your account? Please email us at [email protected].

Your input and feedback on our security is always appreciated. Keeping your data safe is an ongoing effort, and we're glad to have you as part of it.

By using SenseFolks, you agree to the Terms of Service, Privacy Policy, and related policies. If you have questions, please Contact Us.