Security

We take the security of Clipo seriously.

How we protect your data

• All connections use HTTPS with HSTS.
• Passwords are hashed with bcrypt; API keys are stored as SHA-256 hashes.
• Optional AES-256-GCM encryption at rest for uploads, with per-file keys wrapped by a server master key.
• Two-factor authentication (TOTP) is available for every account.
• Uploaded files are served with strict content types and never executed; HTML, SVG and scripts are served as plain text or downloads.
• Rate limiting on authentication and API endpoints.

Reporting a vulnerability

If you believe you have found a security issue, please report it responsibly via the abuse form. Include steps to reproduce. We will acknowledge your report promptly and keep you updated. Please do not access other users' data or disrupt the Service while testing.

Scope

This site, its API and the official apps. Third-party services (Stripe, DNS providers) are out of scope.