Security Overview

This page summarizes the practical security measures Clueinbox has in place. It's a plain-English overview, not a compliance certification.

Passwords and authentication

• Passwords are hashed with Argon2, a modern memory-hard hashing algorithm. We never store or can recover a plain-text password.
• Sessions use signed JWTs; sign-in and password-reset endpoints are rate-limited to blunt automated credential-stuffing attempts.
• Password resets and email verification use time-limited, single-use codes, never a plain-text link containing the code.

Data isolation

Every request for a campaign, its feedback, or its analysis is checked against the signed-in account before any data is returned, so one business owner can never read another's campaigns, feedback, or billing information, by account ID or by guessing a URL.

Payments

Payments are processed by Paystack; Clueinbox never sees or stores your card details. Payment confirmations arrive via a webhook whose signature is cryptographically verified before we act on it, so a forged payment notification is rejected.

Abuse protection

• The public feedback endpoint is rate-limited per IP address to blunt spam and scripted submissions.
• Submitted comments are screened by an automated filter and flagged for the owner's attention. They are never silently blocked, since a false positive shouldn't erase real feedback.

Data minimization

Customers never create an account to leave feedback, and we don't collect their name, email, or phone number. Their IP address is used only transiently to enforce a rate limit and is never stored.

Reporting a concern

If you believe you've found a security issue, email support@clueinbox.com with details. Please don't publicly disclose a vulnerability before we've had a chance to address it.