Security

Reporting a vulnerability

Found a security issue? Email support@homeheeros.com with the steps to reproduce it. Please don't access other people's data, disrupt the service or publish the issue before we've fixed it. We'll confirm receipt within 3 business days and keep you updated. We don't take legal action against good-faith research that follows these rules.

How we protect data

• Encrypted connections only (HTTPS with HSTS), strict Content Security Policy, no third-party scripts before consent.
• Passwords stored as salted bcrypt hashes; one-time links stored only as hashes and short-lived; rate limits on sign-in, codes and emails.
• Hosting and database in the EU; private files only served to authorised people; staff access to documents is logged.
• Payment and identity data stays with Stripe (PCI DSS certified).
• Automatic deletion of data that is no longer needed (see the retention table in the privacy policy).