Security at Ontu

• Passwords must be 10–128 characters and are stored only as strong, salted hashes.
• Sessions use an opaque token in an HttpOnly, SameSite cookie; we store only a SHA-256 hash of it.
• Changing or resetting your password signs out other sessions. You can review and revoke sessions in settings.
• State-changing requests are protected against cross-site request forgery by checking their origin.

• Pages never accept raw HTML or scripts. All text is rendered as plain, escaped text.
• Links and images are validated; only safe protocols and public addresses are allowed.
• Embeds are limited to known providers, and we generate the embed address ourselves.
• Enquiry forms include spam protection and require visitor consent.

• Traffic is encrypted in transit with TLS.
• Uploaded files are type-checked from their contents and size-limited.
• Our link-preview fetcher blocks private network addresses and limits size and time to prevent abuse.
• Administrative actions are restricted by role and recorded in audit logs.
• Payments are handled by Razorpay and Stripe; we never store full card numbers. Payment webhooks are signature-verified.

You can export your data or delete your account at any time from settings. See our Privacy Policy for retention details.

If you believe you've found a security issue, please email support@ontu.in with the subject “Security” and include steps to reproduce. We'll acknowledge your report, keep you updated, and credit you if you'd like once it's fixed.

Please act in good faith:

• Don't access, change or delete other people's data — use test accounts you own.
• Don't run denial-of-service tests, spam, or social engineering against users or staff.
• Give us reasonable time to fix the issue before sharing it publicly.

We won't pursue legal action against researchers who follow these guidelines.

Live API and database health is on our status page.