Security

1. Infrastructure

The website and its small back end run on Cloudflare's global network. Pages are static files, and the only server code handles our forms and the back office. We do not run our own servers.

2. Encryption

• In transit: the site is served over HTTPS only, and plain HTTP requests are redirected to HTTPS.
• At rest: form submissions are stored in a Cloudflare D1 database, which Cloudflare encrypts at rest.

3. Access control

• The back office has one login, whose credentials are stored as encrypted Worker secrets and never in the code.
• Sessions use a random token. Only a hash of it is stored on our side, and the cookie is HttpOnly and expires after 7 days.
• Login attempts and form submissions are rate limited, and forms use a hidden field to catch bots.
• Requests that change data must come from our own site, which blocks cross-site request forgery.

4. Payments

Card payments are made on a page run by Airwallex. We never see, receive or store your card number. Airwallex states that its payment gateway is certified to PCI DSS Level 1. We receive only a payment confirmation and a reference.

5. What stays in your browser

The site uses no analytics or advertising trackers. The only thing kept in your browser is a note that you closed the cookie notice. See the Cookie Policy.

6. Retention and deletion

We keep data only as long as stated in the Privacy Policy, and old records are deleted automatically every day. To have your data deleted sooner, write to contact@replyingo.com and choose “Privacy request”.

7. Minimal data

We do not ask for passwords, card details or access to your accounts in our forms. If you want us to publish replies for you, you can add us as a manager of your profile through the platform itself, and remove us at any time.

8. Incident response

If we discover a security incident that affects personal data, we investigate it, limit its effect, and notify affected customers and the supervisory authority where the law requires it, without undue delay.

9. Reporting a vulnerability

If you believe you have found a security problem on this site, please write to contact@replyingo.com with the details. Please give us reasonable time to fix it before you share it publicly, and do not access data that is not yours. We will acknowledge your report within 3 business days.

10. Providers