Legal

Security

Effective 23 August 2026 · HyperVertual · Digital subscription software

HyperVertual is a hosted web application. We take reasonable technical and organisational measures appropriate to a small SaaS product.

Passwords stored with bcrypt (not reversible encryption).
HTTPS on the production domain.
CSRF tokens on state-changing forms.
Session cookies: HTTP-only, SameSite=Lax, Secure in production.
Direct web access to source, templates, and config directories is blocked via server rules.
Admin features restricted to accounts marked as administrators.
Card data handled by Stripe; we do not store PAN or CVV.

Report a vulnerability to info@hypervertual.com. Do not publicly disclose until we have had a reasonable chance to fix it. We do not run a paid bug bounty unless advertised.