Trust
Security practices
What we actually do to protect accounts and lab work. These are our own statements about how Signal9 is built and operated — not a third-party audit.
Controls in place today
- Authentication
- Sign in with email and password or a one-time emailed link. Passwords are hashed with argon2 and never stored in readable form. Changing or resetting your password signs out every other session. Operator access is limited to a fixed allowlist of staff accounts.
- Authorisation and data isolation
- Every account request is authenticated, and the API scopes reads and writes to the signed-in account, so learners can only read and change their own progress. Admin endpoints check the staff allowlist or a separate admin key.
- Encryption
- All traffic to Signal9 and its API is served over HTTPS/TLS, and plain HTTP is redirected. Data lives on managed hosting (Fly.io and Vercel); we don't operate our own physical servers.
- Rate limiting and abuse guards
- Sign-in, password reset, answer submission, grading and other public endpoints are rate-limited server-side. Lab launches have a per-user throttle, a concurrency limit and daily fair-use caps.
- Grading integrity
- Lab objectives are graded on the server against the real state of your lab machine. The browser never reports its own score.
- Transactional mail (sign-in links and password resets) is sent through our email provider from a verified sending domain.
- Data retention
- Account and progress data is kept while your account exists. You can delete your account from settings at any time, which removes every record tied to it.
Certifications
Signal9 does not currently hold a SOC 2, ISO 27001 or comparable third-party certification, and we don't claim one. If your procurement process needs a security questionnaire completed, email us and we'll work through it directly.
Reporting a vulnerability
Send findings to security@signal9.sh. Include the affected URL, reproduction steps and any proof-of-concept output. We aim to acknowledge reports within two business days and to keep you updated until the issue is closed.
Please test only against your own account, avoid automated scanning that degrades the service for others, and don't access or modify another person's data. We won't pursue action against good-faith research that follows those rules.
Related pages
- Privacy policy — what we collect and why.
- Subprocessors and data processing — who else touches the data.
- System status — live component health.