Security Overview

Encryption in transit

All public traffic to pilot.askqa.app is served over HTTPS (TLS). Cloudflare terminates TLS at the edge; origin connections to our application host are also encrypted.

Session authentication

• After login or demo entry, we issue an HTTP-only cookie named pilotbreak_session.
• The cookie value is a signed token: JSON payload + HMAC-SHA256 signature using a server secret (SESSION_SECRET). Signatures are verified with timing-safe comparison on every authenticated request.
• Tokens expire after seven days. In production, cookies are marked Secure and SameSite=Lax.
• We do not store session state in the database — the signed cookie is the session.

Passwords & demo access

• User passwords are hashed before storage (bcrypt).
• No shared demo password. The public demo creates an isolated, read-only sandbox organization per session via POST /api/demo/enter. Demo users cannot mutate production data.
• Legacy shared demo accounts are blocked in production; demo access is API-only through the sandbox flow.

Rate limiting on authentication

We apply in-memory rate limits on sensitive endpoints (single-instance deployment):

• Login — 5 attempts per 15 minutes per IP and per email (HTTP 429 with Retry-After).
• Signup — IP-based limits to reduce automated account creation.
• Demo entry — 20 entries per 15 minutes per IP.
• Public scorecard & contact — IP-based limits to reduce spam.

Data storage

Application data (organizations, pilots, baselines, leads, audit logs) is stored in PostgreSQL on Neon. See our Data Processing Note for region details.

Tenant isolation

API routes enforce organization scope from the session — users can only read or write data for their own organization unless using the isolated demo sandbox.

Reporting issues

Security concerns: pilot@askqa.app (subject line “Security”).