Security

Encryption in transit

The website and its API are served over HTTPS, and connections are encrypted between your browser and our delivery network.

Accounts and sessions

• Passwords are hashed and never stored in plain text.
• Session cookies are marked HttpOnly and Secure so scripts cannot read them.
• Cross-origin requests are restricted to the site’s own origin.

Infrastructure and access

• The site is hosted on AWS and deployed through an automated pipeline that authenticates with short-lived credentials rather than stored keys.
• Production secrets are kept in environment configuration, not in source code.
• Access is limited to the people who need it, on a least-privilege basis.

Engineering practices

• Every change passes automated type checks, a build and an SEO and integrity check before it can be deployed.
• Dependencies are tracked in lockfiles and updated regularly.
• We review code before it ships and fix reported issues promptly.

Certifications

We do not currently hold third-party security certifications such as SOC 2 or ISO 27001. If you need details of our controls for a vendor review, contact us and we will share what we can.

Report a vulnerability

If you believe you have found a security issue, please email support@tera2nano.com with “Security” in the subject and enough detail to reproduce it. Please give us reasonable time to fix it before sharing it publicly, do not access or change other people’s data, and do not degrade the service. We will acknowledge your report and keep you updated. We do not currently run a paid bug-bounty programme.