Security is designed in, not bolted on.

How we protect your account, your diagrams and your API keys. Every control on this page is implemented in the open source code you can review on GitHub.

Identity and access

• Strong passwords — At least 12 characters with upper and lower case, digits and symbols. Stored as bcrypt hashes, never in plain text.
• Multi-factor authentication — TOTP apps (Google Authenticator, Authy) and email codes that expire in 10 minutes, plus 8 single-use recovery codes.
• Bounded sessions — JWT sessions of 2 days (5 with MFA), automatically revoked when the password changes.
• Brute-force protection — Up to 10 login attempts per IP per minute, and a 15-minute account lockout after 5 consecutive failures.
• Sign in with Google — OAuth 2.0 / OpenID Connect with a 10-minute state token and signature, issuer, audience and expiry checks.

Data protection

• API keys encrypted at rest — AI provider and payment gateway keys are encrypted with Fernet (AES-128 + HMAC-SHA256) and only shown masked.
• Encryption in transit — In production, a 2-year HSTS policy with includeSubDomains and preload.
• Controlled sharing — Access codes stored as hashes, configurable expiry, and access logs with hashed IP addresses.
• Your data is yours — Export whole projects to ZIP or Markdown anytime, and delete your account and all its data from settings.

Application security

• Security headers — X-Frame-Options DENY, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cache-Control no-store and a strict CSP on the API.
• Abuse limits — Rate limiting on login, MFA, rendering, export, import, OAuth and public links, plus per-request size limits.
• Safe imports — Protection against malicious ZIPs (up to 500 files and 50 MB uncompressed), a preview before anything is created, and all-or-nothing rollback.
• Sanitized content — Diagram SVGs are sanitized with DOMPurify before they are displayed, to prevent XSS.
• Hardened production — Interactive API docs disabled, no stack traces exposed, and containers that run without root privileges.

Monitoring and secure development

• Audit logging — Records sign-ins, failures, lockouts, password changes, MFA and OAuth events, with automatic 90-day retention.
• Error monitoring without personal data — Optional Sentry integration that strips personal information before each event is sent.
• Continuous scanning with Snyk — Dependency scanning, static code analysis (SAST) and container image scanning through Snyk's open source program.
• Payments that never touch your card — Payments are processed by Stripe; we never store card data, and every webhook is signature-verified.

Responsible disclosure

Found a vulnerability? Report it privately through GitHub Security Advisories, not in a public issue. We review every report and publish fixes in the release notes.

DiagramaHub is in beta (v0.x). We don't hold formal certifications such as SOC 2 or ISO 27001 yet; this page lists what is in place today.