---
title: "Security — Palaestral"
description: "How Palaestral keeps an account, a card and a client's record safe: no passwords, no card numbers held, encryption in transit and at rest, reporting a problem."
canonical: "https://palaestral.com/security"
---

# Security

What keeps an instructor's business and a client's record safe here, in the terms the system is built in. Each statement on this page about how it is built is checked against it by an automated test, so the page cannot go on saying something after it stops being true.

1. [Signing in](https://palaestral.com/security#signing-in)
2. [Cards](https://palaestral.com/security#cards)
3. [In transit and at rest](https://palaestral.com/security#in-transit-and-at-rest)
4. [Who can see what](https://palaestral.com/security#who-can-see-what)
5. [Backups](https://palaestral.com/security#backups)
6. [What is kept, and for how long](https://palaestral.com/security#what-is-kept-and-for-how-long)
7. [Reporting a problem](https://palaestral.com/security#reporting-a-problem)

## Signing in

There are no passwords, so there is none to guess, to reuse from another site or to take. Signing in sends a link to an email address, or a 6-digit code for the Palaestral app, and an instructor can sign in with Google instead. A link works once, for 15 minutes, and a code once, for 10 minutes.

Neither is kept as it was sent. What is stored is a digest of it, which cannot be turned back into the link or the code, so a copy of the database signs nobody in.

## Cards

Card numbers never reach Palaestral. A card is entered on Stripe's own page and charged on the instructor's own Stripe account. What is kept of a card a client saves is what they recognise it by — its brand, its last four digits and its expiry — and Stripe's own reference to it.

## In transit and at rest

Every page and every request is served over HTTPS. A request made without it is redirected, browsers are told to use nothing else, and a connection made with an outdated version of the protocol is refused. The database refuses a connection that is not encrypted.

What is stored is encrypted where it is stored: the database, the scans of an instructor's credentials, the copies of records people ask for, the list for instructor signups, and the site's own pages. Nowhere files are kept can be read by the public directly.

## Who can see what

An instructor's notes about a client, their lesson plans and their payment records are theirs. A studio an instructor teaches at sees its own schedule and who is booked into it, and reads none of those.

## Backups

The database is backed up automatically, and can be restored to any moment its backups reach.

## What is kept, and for how long

The [privacy page](https://palaestral.com/privacy) states every period, in the numbers the deletion job enforces, and what a deletion request keeps.

## Reporting a problem

Write to [security@bricksofa.com](mailto:security@bricksofa.com), where Brick Sofa reads security reports for every product it makes, with enough detail to reproduce what you found. Please do not test against a real instructor's bookings or a real client's data. The same address is in this site's `security.txt`, at the address RFC 9116 gives it.

[Accessibility](https://palaestral.com/accessibility)