Which protects your account and data.
No marketing promise: these are precisely the measures in place, as audited on July 19, 2026.
Account, session & forms
Anti-session fixation
The session identifier is regenerated at each connection and registration; disconnection actually destroys the server-side session.
CSRF protection
Each sensitive form (connexion, registration, disconnection, purchase, license deactivation) loads a checked token on the server side.
Passwords
Hashed with PHP default algorithm (password_hash), never stored or logged.
Flow limitation
Connection, registration, forgotten password and license API are each limited by time window, by IP address.
Headers & data access
Safety headers
HSTS, per-request nonce-based Content-Security-Policy (without 'unsafe-inline'),
X-Frame-Options: DENY, X-Content-Type-Options: nosniff,
Refer-Policy and Permissions-Policy on each response, including error pages.
Data isolation (IDOR)
Each access to a license or download checks that the resource belongs to the connected account before serving it.
Signed Verdict, never falsifiable
Each response from the License Verification API is signed by HMAC-SHA256 on the server side, an adapter cannot make a valid verdict without knowing the signature secret.