CardfolioIQ

Security at CardfolioIQ™

Your card collection data and account security are our top priority. Here's exactly how we protect you.

All systems operational

Account Security

  • Passwords hashed using a strong adaptive algorithm — never stored in plain text
  • Minimum 12-character passwords with uppercase, lowercase, number, and special character required
  • Brute-force lockout after 5 failed attempts (30-minute cooldown)
  • Two-factor authentication (2FA) via authenticator app — coming soon
  • Google Sign-In support (OAuth 2.0)
  • Suspicious login detection — unusual IPs and multi-location access are flagged and logged

Data Encryption

  • All data in transit encrypted with TLS 1.2+ (HTTPS enforced site-wide)
  • HSTS (HTTP Strict Transport Security) with 1-year max-age and preload
  • Session tokens are HttpOnly, Secure, and SameSite cookies — not accessible to JavaScript
  • Database credentials and API keys stored as encrypted secrets, never in source code
  • Sensitive fields (payment tokens) handled exclusively by Stripe — never stored on our servers

API & Infrastructure Protection

  • Protected account and member API endpoints require authenticated sessions; intentionally public endpoints use separate access controls and rate limiting
  • Tiered rate limiting applied across all endpoints — stricter limits on authentication, AI, and pricing routes
  • Input validation on every endpoint — SQL injection and XSS patterns blocked server-side
  • Content Security Policy (CSP) headers restrict script and resource origins
  • Bot and scraper detection on pricing and AI endpoints
  • Proprietary valuation algorithm weights and internal factors stripped from all API responses

Card Image Security

  • Uploaded card images scanned for malware patterns before processing
  • MIME type and magic-byte verification — file type must match declared content
  • 10 MB maximum upload size enforced server-side
  • Images processed server-side and never executed
  • Signed URL access controls for private image storage — planned

Monitoring & Incident Response

  • All authentication attempts (success and failure) are logged with IP and timestamp
  • Authentication failures, brute-force attempts, and injection patterns are logged with IP and timestamp for review
  • Dependency vulnerability scanning available via audit tooling
  • Security headers verified on every deployment
  • Incident response: critical issues addressed within 24 hours

Privacy & Compliance

  • GDPR-aware data handling — you can request deletion of your account and data
  • CCPA-compliant — California residents can request data access or deletion
  • No sale of personal data to third parties
  • Cookie consent banner with granular controls
  • Clear Privacy Policy and Terms of Service

Platform-level security (outside this app)

Some security layers operate at the infrastructure level and are managed by our hosting provider rather than application code. These include:

  • Web Application Firewall (WAF) — configured at the CDN/load-balancer layer
  • DDoS mitigation — handled by Cloudflare at the network edge
  • Database network isolation — database is not publicly exposed; access is restricted to application servers
  • Automated encrypted backups — managed by the database provider with point-in-time recovery
  • AWS cloud infrastructure — compute, storage, and networking security managed by the platform

Responsible Disclosure

If you discover a security vulnerability in CardfolioIQ™, please report it responsibly. We take all reports seriously and will respond promptly.

Email: security@cardfolioiq.com — include "Security Disclosure" in the subject line.

Please do not publicly disclose vulnerabilities until we've had a reasonable opportunity to investigate and address them. We appreciate your help keeping CardfolioIQ™ secure.

Last updated: August 2026 · Questions? security@cardfolioiq.com