Security

Last updated: August 10, 2026

API keys

• Keys use evq- prefix with 256-bit entropy; only SHA-256 hashes are stored.
• Rotate or revoke keys instantly from the dashboard.
• Production bootstrap requires email, blocks reserved project names, and is rate-limited per IP and email.
• Unsigned Stripe/PayPal webhooks are rejected in production; Pro keys are emailed, never logged.
• JWT token exchange is rate-limited; dev internal-key bypass is disabled in production.
• Login and key lifecycle events are stored in an immutable auth audit log (IP, outcome, timestamp — never secrets).

Transport & secrets

• All endpoints served over HTTPS (TLS 1.2+).
• JWT secrets and internal keys must be set in production — the API refuses to start with defaults.
• Dashboard sessions use short-lived JWTs (1 hour); refresh re-issues tokens server-side without persisting API keys in the browser.

Data protection

• PII redaction on ingest (email, card, SSN, phone patterns).
• PostgreSQL in production; SQLite disabled in production deploys.
• Containers run as non-root user.

Report a vulnerability

Email [email protected] with details. We aim to respond within 48 hours.

Status

Live status page: evidqo.com/status · Raw health: api.evidqo.com/health