Cardfolio IQ

Security at Cardfolio IQ

Your card collection data and account security are our top priority. Here's exactly how we protect you.

All systems operational

Account Security

  • Passwords hashed with bcrypt (cost factor 12) — never stored in plain text
  • Minimum 12-character passwords with uppercase, lowercase, number, and special character required
  • Brute-force lockout after 5 failed attempts (30-minute cooldown)
  • Two-factor authentication (2FA) via authenticator app — coming soon
  • Google and Apple Sign-In support (OAuth 2.0)
  • Suspicious login detection — unusual IPs and multi-location access are flagged and logged

Data Encryption

  • All data in transit encrypted with TLS 1.2+ (HTTPS enforced site-wide)
  • HSTS (HTTP Strict Transport Security) with 1-year max-age and preload
  • Session tokens are HttpOnly, Secure, and SameSite cookies — not accessible to JavaScript
  • Database credentials and API keys stored as encrypted secrets, never in source code
  • Sensitive fields (payment tokens) handled exclusively by Stripe — never stored on our servers

API & Infrastructure Protection

  • All API endpoints require authenticated sessions (JWT via BetterAuth)
  • Tiered rate limiting: auth (10/15 min), AI (20/min), pricing (30/min), general (120/min)
  • Input validation on every endpoint — SQL injection and XSS patterns blocked server-side
  • Content Security Policy (CSP) headers restrict script and resource origins
  • Bot and scraper detection on pricing and AI endpoints
  • Proprietary valuation algorithm weights and internal factors stripped from all API responses

Card Image Security

  • Uploaded card images scanned for malware patterns before processing
  • MIME type and magic-byte verification — file type must match declared content
  • 10 MB maximum upload size enforced server-side
  • Images processed server-side and never executed
  • Signed URL access controls planned for private image storage

Monitoring & Incident Response

  • All authentication attempts (success and failure) are logged with IP and timestamp
  • Automated alerts for brute-force attempts, multi-IP logins, and injection attempts
  • Dependency vulnerability scanning on every build
  • Security headers verified on every deployment
  • Incident response: critical issues addressed within 24 hours

Privacy & Compliance

  • GDPR-aware data handling — you can request deletion of your account and data
  • CCPA-compliant — California residents can request data access or deletion
  • No sale of personal data to third parties
  • Cookie consent banner with granular controls
  • Clear Privacy Policy and Terms of Service

Platform-level security (outside this app)

Some security layers operate at the infrastructure level and are managed by our hosting provider rather than application code. These include:

  • Web Application Firewall (WAF) — configured at the CDN/load-balancer layer
  • DDoS mitigation — handled by Cloudflare at the network edge
  • Database network isolation — database is not publicly exposed; access is restricted to application servers
  • Automated encrypted backups — managed by the database provider with point-in-time recovery
  • AWS cloud infrastructure — compute, storage, and networking security managed by the platform

Responsible Disclosure

If you discover a security vulnerability in Cardfolio IQ, please report it responsibly. We take all reports seriously and will respond promptly.

Email: [email protected] — include "Security Disclosure" in the subject line.

Please do not publicly disclose vulnerabilities until we've had a reasonable opportunity to investigate and address them. We appreciate your help keeping Cardfolio IQ secure.

Last updated: July 2026 · Questions? [email protected]