Security

How we protect your data

• Encryption: HTTPS everywhere, with HSTS. The database, backups and receipts are encrypted at rest.
• Passwords: stored with Argon2id, a slow one-way hash. New passwords are checked against known breaches with a method that never sends the password itself.
• Sign-in protection: email verification, rate limits and lockouts that grow after repeated failures, and an email whenever a new device signs in.
• Access control: every request checks that you're a member of the Space and that your role allows the action. Spaces you aren't in look like they don't exist.
• Receipts: never public. They open only through short-lived signed links, and only for current Space members.
• Browser protections: a strict content security policy, no third-party scripts, and protection against cross-site requests.
• Audit trail: changes are recorded with who made them, and security events such as exports and role changes are logged.
• Backups: daily, with point-in-time recovery, and we test restoring them every quarter.

What you can do

• Use a long, unique password, or sign in with Google or Apple.
• Turn on app lock in Settings → Security, so Peak asks for a PIN or Face ID / fingerprint when it's been left open.
• Lost a device? Settings → Security → “Sign out everywhere”.
• Give people the smallest role they need: Viewer if they only need to look.

Reporting a vulnerability

If you find a security problem, email security@fintrekking.com with the details and steps to reproduce. Please don't access other people's data or disrupt the service while testing. We'll confirm receipt within 3 working days, keep you updated, and credit you if you'd like.