Security
Security Policy
Reporting a vulnerability
Email [email protected] with a description of the issue and the steps to reproduce it. We aim to reply within 48 hours and to fix critical issues within 7 days.
Please give us the chance to fix the issue before you disclose it publicly. If we have not replied within 7 days, you may disclose it. On request, we credit researchers who report valid issues.
Scope
In scope:
dpplive.comand its subdomains- The DPPLive API
- Public passport pages
Out of scope:
- Third-party services such as Cloudflare, bKash and Telegram: please report to them directly
- Social engineering against staff or factory users
- Physical attacks
- Denial-of-service attacks
How we protect accounts and data
| Area | What we do |
|---|---|
| Passwords | Hashed with scrypt (N = 216) and a random salt for each user. Passwords are never stored in plain text. |
| Sign-in | Two-factor authentication with an authenticator app or an email code. Sign-in attempts are rate-limited, and an account locks for a while after repeated failed attempts. |
| Sessions | Signed access tokens that expire after 15 minutes, and 30-day refresh tokens that we can revoke on the server. |
| Access control | Signed-in API requests are checked against the user's role and factory. |
| Input | Input is validated on the server against a schema before it is stored. |
| Transport and headers | HTTPS only, with HSTS, a Content Security Policy and other security headers on every page. |
| Secrets | Two-factor secrets are encrypted at rest with AES-GCM. |
| Audit | Changes to passports and accounts are written to an audit log. |
| Backups | The database is backed up every week, and we keep 12 weeks of backups. |
| Data location | Database and file storage are hosted in Cloudflare's Western Europe (WEUR) location. That is set with a location hint, a placement preference, not an EU data-residency guarantee. |
| Passport integrity | Each published passport version gets a SHA-256 fingerprint, timestamped on the Bitcoin blockchain through OpenTimestamps. Anyone can check it at dpplive.com/verify. |
Compliance commitments
- ESPR Regulation (EU) 2024/1781: Article 9(1) (accurate, complete and up-to-date data) and Articles 10–11 (passport requirements, integrity and security)
- GDPR: DPO appointed, records of processing maintained, 72-hour breach notification, a DPIA before each new processing activity
- ISO 27001: controls aligned (full certification is a separate roadmap)
- Bangladesh Personal Data Protection Ordinance, 2025: data subject rights honoured
How we handle personal data is set out in our privacy policy.