This page summarizes the measures GeoVerdict takes to protect customer data. It describes what is actually in place today, without embellishment.
Infrastructure
- GeoVerdict runs entirely on Cloudflare's serverless platform (Workers). There are no self-managed servers or operating systems to patch.
- The primary database (Cloudflare D1) and the geocode cache (Cloudflare KV) are stored in Cloudflare's Western Europe region (Amsterdam).
- All traffic is served over HTTPS with TLS termination at Cloudflare's edge. There is no unencrypted endpoint.
Credentials and secrets
- API keys and console session tokens are stored as SHA-256 hashes. The plaintext of a key is shown exactly once at creation.
- Recently created API keys are additionally stored AES-256-GCM encrypted so the account owner can reveal them in the console. The encryption key is held as a Worker secret and never stored in the database. Reveal is refused for administrators acting on another account.
- Credentials for geocoding data sources are stored AES-256-GCM encrypted and are never returned in plaintext by any API.
- Application secrets live in Cloudflare Worker secrets, not in the codebase.
Authentication
- Sign-in is passwordless: a single-use magic link with a 256-bit token, valid for 15 minutes, delivered by email, with a rate-limited 6-digit code as fallback (maximum 5 attempts). Both are stored hashed and are consumed on use.
- Magic-link credentials are random, single-use and expire after 15 minutes. They are removed from browser history before being exchanged through the sign-in API.
- Console sessions use HttpOnly, same-site cookies and expire after 30 days.
- Browser widget tokens are separate, project-scoped credentials restricted to an exact list of HTTPS origins, limited to the autocomplete endpoint, and rate limited per token and per origin. Server API keys are rejected on the browser endpoint and vice versa.
Payments
- Checkout happens exclusively on Stripe-hosted pages. Card data never touches GeoVerdict systems.
- GeoVerdict holds no Stripe API key. The only Stripe credential in the platform is a webhook signing secret, and every incoming webhook is verified (HMAC-SHA256, constant-time comparison, 5-minute timestamp tolerance).
Application safeguards
- Every request body is schema-validated before processing.
- Geocoding data sources receive only the address query, never account or end-user identity.
- The public homepage demo is rate limited using a salted hash of the visitor IP; raw IP addresses are never stored, and the hashes are deleted after 30 days.
- Administrative changes to customer accounts are recorded in an audit log.
- Provider credentials are redacted from error traces and logs.
What we do not claim
GeoVerdict does not currently hold SOC 2 or ISO 27001 certification, and there is no formal bug bounty program. We would rather say that plainly than imply otherwise.
Reporting a vulnerability
If you believe you have found a security issue, email support@geoverdict.com with steps to reproduce. We appreciate coordinated disclosure: please avoid accessing other people's data or disrupting the service while testing, and give us reasonable time to fix the issue before publishing. We respond as quickly as we can.