How we keep you safe

We follow a "defense in depth" approach: multiple independent layers so that no single failure exposes your data. No system is ever 100% unhackable, but we've worked hard to make MovingMon a very hard target and to limit the blast radius if something does go wrong.

Every connection to MovingMon is encrypted with TLS (HTTPS). We automatically redirect insecure requests to HTTPS and send a HTTP Strict Transport Security (HSTS) header so browsers refuse to connect over plain HTTP. Certificates are issued by Let's Encrypt and renewed automatically.

• • Strong password policy — at least 12 characters with a mix of upper/lowercase, numbers, and symbols.
• • Breached-password screening — new passwords are checked against known data-breach corpora and rejected if compromised.
• • Two-factor authentication (2FA) — optional authenticator-app codes with one-time recovery codes.
• • Login throttling & lockout — repeated failed logins are rate-limited to stop brute-force guessing.
• • Verified email — accounts confirm their address, and disposable/temp-mail domains are blocked.

The application sends a strict set of browser security headers on every response:

• • Content-Security-Policy — restricts scripts, styles, and other content to trusted sources, sharply reducing the risk of cross-site scripting (XSS).
• • Clickjacking protection — X-Frame-Options: DENY and frame-ancestors 'none' prevent the site from being embedded in malicious frames.
• • CSRF protection — every form is protected against cross-site request forgery.
• • No MIME sniffing, tight referrer & permissions policies, and we don't advertise our software versions.

• • Rate limiting on sensitive actions (sign-up, password reset, login) to blunt automated attacks.
• • Automatic IP banning — addresses that scan for vulnerabilities or flood the site with probes are temporarily blocked.
• • Network-level protection — a firewall limits exposed services, and an intrusion-prevention tool (fail2ban) bans repeat offenders at the edge.

• • Passwords are stored as salted one-way hashes — we can never see or recover your actual password.
• • Two-factor secrets and recovery codes are encrypted at rest.
• • Session data is encrypted, and session cookies are HTTP-only, Secure, and SameSite-protected.
• • Database access is restricted to the application on the server and is not exposed to the public internet.

We keep an audit log of requests and security events (such as failed logins and probe attempts) so we can detect and respond to suspicious activity. These logs are automatically pruned after a limited retention window. See our Privacy Policy for exactly what's recorded and for how long.

The server applies operating-system security updates automatically. Code changes pass an automated test and code-style suite before they can be deployed, which reduces the chance of shipping a security-relevant bug.

Security is a shared effort. To keep your account safe:

• ✓ Use a long, unique password you don't use anywhere else.
• ✓ Turn on two-factor authentication in your account's Security settings.
• ✓ Never share your password or 2FA codes, and be wary of phishing emails.

Found a security issue? We genuinely appreciate responsible disclosure. Please email security@movingmon.cloud with the details and steps to reproduce, and give us a reasonable chance to fix it before publishing. We won't pursue action against good-faith researchers who follow this process.