Security Overview

Updated on August 4, 2026. These policies are adapted from the Basecamp Open-Source Policies / CC BY 4.0

SenseFolksis a product research platform developed by Projckt, India. We protect accounts and research data with encryption in transit, Argon2 password hashing, access controls, backups, and the safeguards below.

Contents

• Authentication and access control
• Data protection
• Transport security
• Application security
• Infrastructure
• Billing and payment security
• Monitoring and incident response
• Law enforcement
• Data deletion
• Report an incident

Authentication and access control

Redis backs our session-based authentication. Sessions expire after a defined period of inactivity, and logout invalidates session tokens. We also support Google OAuth.

Passwords are never stored in plain text. We hash them with Argon2, a memory-hard algorithm designed to resist brute-force and GPU attacks.

Data protection

We follow database performance and reliability best practices, with encrypted backups at regular daily intervals. Cloudinary stores uploaded files with access controls.

Transport security

All data sent between you and us uses HTTPS, with TLS enforced on every connection. Transfers within private networks are also encrypted. Cloudflare adds DNS security and DDoS protection.

Application security

• CSRF protection: Anti-CSRF tokens validate every state-changing request to prevent malicious sites acting on your behalf.

• Rate limits: API and authentication routes limit requests to prevent brute-force attacks and abuse.

• CORS: Cross-origin requests are restricted to approved domains.

• Content Security Policy (CSP): Strict headers control browser resource loading to prevent XSS and other injection attacks.

• Bot protection: Rate limits and origin validation protect sensitive flows at app.sensefolks.com from automated abuse.

Infrastructure

SenseFolks runs on Hetzner cloud servers. Cloudflare provides CDN, DNS, and security services. We apply the latest security patches regularly, restrict the network with firewalls, and monitor it.

Billing and payment security

SenseFolks is currently available on the Free plan only. There is no checkout, we do not collect payment details, and we do not store credit card information.

Paddle is listed as the planned payment provider, but payment processing is not active and no SenseFolks payment data is sent to Paddle. We will update this overview before paid upgrades launch.

Monitoring and incident response

We continuously monitor for suspicious activity against our domains. As of this overview's date, we have had no data breach. If an attack succeeds, we will immediately notify all affected customers.

We audit internal access. Employees who wrongly access customer data face penalties ranging from termination to prosecution.

Law enforcement

Projckt discloses data to law enforcement only when required by valid legal process. We reject invalid requests and notify affected users of requests unless legally prohibited.

Data deletion

Deleting your account makes all content inaccessible immediately. We permanently delete it from all servers and logs within 30 days, and from backups within 60 days. Permanently deleted data cannot be recovered.

Report an incident

Report abuse, misuse, exploits, or account incidents to [email protected].

By using SenseFolks, you agree to the Terms of Service, Privacy Policy, and related policies. For questions, contact us.