ShopTorque · by Streetwise Software Online · SWSO
Security
Your financial records deserve care. This page describes the protections built into ShopTorque today. We only list measures that are actually in the software.
Your account
- Passwords are stored only as salted one-way hashes made with PHP's password_hash function; nobody can read your password, including us. Passwords must be at least 8 characters and mix letters and numbers.
- Repeated failed sign-ins are slowed down: after 5 failed attempts for one email, or 20 from one network address, within 15 minutes, sign-in is paused.
- Your session ID is replaced every time you sign in, and the session cookie is HttpOnly and SameSite=Lax, and marked Secure when the site is served over HTTPS.
- Every form and data change requires a secret anti-forgery (CSRF) token.
Your data stays yours
- Every record is tied to its owner, and every read or change checks that it belongs to the signed-in shop account, so one customer can never open another customer's data.
- All database queries use prepared statements, which prevents SQL injection, and everything shown on screen is escaped to prevent cross-site scripting.
- The database sits in a private folder that the web server refuses to serve.
- Spreadsheet exports are protected against formula injection.
- Uploaded import files (up to 10 MB) are read and then discarded; only the records they contain are saved, with duplicates skipped.
The browser side
- A strict Content Security Policy only allows scripts and styles from ShopTorque itself, plus NHTSA's VIN decoder when you press "Decode", and pages cannot be framed by other sites.
- No third-party trackers, analytics, advertising or font services are loaded.
Payments
Card payments are handled entirely by Stripe on Stripe's secure checkout. Card numbers never reach our servers. Messages from Stripe to ShopTorque are accepted only when their cryptographic signature checks out and is less than five minutes old.
What you can do
- Use a long password you do not use anywhere else, and sign out on shared computers.
- Export a backup of your data from time to time.
- Tell us straight away if you notice anything unusual on your account.
What we do not claim
ShopTorque does not yet offer two-factor sign-in, and we do not currently hold third-party security certifications such as SOC 2 or ISO 27001. We will update this page if that changes.
Reporting a security problem
If you believe you have found a vulnerability, please email [support email] with the details and give us a reasonable time to fix it before telling anyone else. Please do not access other people's data or disrupt the Service while testing.