Security

Last updated 6 November 2026

The short version

  • Passwords are stored only as salted hashes; sign-ins expire after a day; two-step sign-in is available.
  • We will never ask for your password, a one-time code or payment details by message or email.
  • Found a vulnerability? Tell us at [email protected]. We will not take action against good-faith research that follows the rules below.

1. How we protect the site

  • Everything is served over encrypted connections (TLS), with strict transport security.
  • Passwords are stored as salted bcrypt hashes and never in readable form. Signing in issues a token that expires after 24 hours.
  • Two-step sign-in with an authenticator app is available in Account and security; staff accounts that administer the site must use it.
  • Sign-in, registration, messaging, connection requests and other sensitive actions are rate-limited to slow down guessing and abuse.
  • A strict content security policy limits what can run in your browser. Uploaded files are checked to be the type they claim, and scripts inside images are refused.
  • The site sits behind Cloudflare; the servers accept web traffic only from it.
  • Databases are backed up nightly; off-site copies are encrypted.

2. Keeping your account safe

Use a password you use nowhere else, and switch on two-step sign-in. Sign out on shared devices. Be wary of anyone — including someone claiming to be from PaymentsDatabase or a payment provider — who asks you for codes, passwords or card details, or to move money urgently. Report it.

3. Reporting a vulnerability

Email [email protected] with what you found, how to reproduce it, and what an attacker could do with it. We aim to acknowledge within three working days and keep you updated until it is fixed. We are glad to credit you once it is, if you would like.

Please: test only against your own account or with permission; do not access, change or keep other people’s data beyond what is needed to show the problem; do not degrade the service (no denial-of-service, spam or automated scanning at volume); do not use social engineering or physical attacks; and give us reasonable time to fix the issue before telling anyone else.

If you follow these rules, we will treat your research as authorised, will not pursue legal action over it, and will work with you. We do not currently run a paid bug bounty.

4. If something goes wrong

If a security incident affects your personal data, we will tell you and, where required, the Information Commissioner’s Office, as set out in the privacy notice.

MEGHR LTD, registered in England and Wales, company number 16502703. Registered office: 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Questions about this policy: [email protected].