How we protect your data

• All traffic is encrypted with HTTPS, and the browser is told to always use HTTPS.
• Your email address and other sensitive fields are stored encrypted in the database.
• Your data export is stored encrypted until you've downloaded it, and is deleted after 7 days.

You log in with a one-time code that we send to your email. The code works for 10 minutes. There's no password that can be leaked or guessed.

We never store IP addresses in plain text, only as a keyed hash value. It's used to prevent misuse and is deleted after 30 days.

• Owners of a company profile must use two-step verification.
• In the dashboard under Settings you can see active sessions and log a device out.

• Never share your login code with anyone. TrustSays never asks you for it.
• If you get a login code you didn't ask for, ignore the email.
• Log out on shared computers. You do it under My profile, Settings, Email.

Write to security@trustsays.com with a description and how it can be reproduced. Read the rules on the security page.