Security

This page describes the real security practices running in Expiroo today, not aspirational ones. If something here ever stops being true, we update the page.

Passwords

Passwords are hashed with PBKDF2-HMAC-SHA256 and a unique random salt per account, using the Web Crypto API. We never store or log a recoverable copy of your password. A password reset invalidates every existing session on the account, so a stolen session token can't survive a reset.

Encrypted credential storage

When an administrator connects a payment provider or a messaging channel, the API keys involved are encrypted at rest with AES-256-GCM before they ever touch the database, a fresh random IV per value. They're decrypted only in memory, only when actually needed to make a request to that provider.

Transport security

All traffic to and from Expiroo is served over HTTPS. There's no unencrypted path to reach the application.

Webhook verification

Every webhook Expiroo receives, from Stripe, PayPal, Telegram, or WhatsApp, is verified against that provider's own signature before we act on it, so a request can't be forged by simply knowing our webhook URL.

Access control

Every domain, monitor, and setting is scoped to the account that owns it, checked on every request, never inferred from a guessable ID in a URL. Admin-only actions (like changing plan pricing or disconnecting a payment provider) require re-entering your password at the time of the action, even with an active session, and are recorded in an audit log.

Rate limiting and abuse prevention

Login, signup, password reset, and the free public tools are all rate-limited to prevent brute-force and abuse.

Reporting a vulnerability

If you've found a security issue, please email alerts@expiroo.com directly rather than filing it publicly, and give us a reasonable window to fix it before disclosure. We take these reports seriously and will respond promptly.