Where Drule runs
Drule's servers and database run in the European Union (Render, Frankfurt, Germany), and the web app is served by Vercel. Backups: [confirm where Render keeps disk snapshots and how they're encrypted]. The full list of providers is on our subprocessors page.
Encryption
- TLS everywhere: every page, API call and live game connection is encrypted in transit, and browsers are told to always use HTTPS (HSTS).
- Encrypted backups of the database.
- Integration secrets — Slack tokens and Teams workflow URLs — are encrypted at rest with AES-256-GCM.
- No card data: payments happen on the Bachs checkout, so card numbers never touch our servers.
Accounts and passwords
- Passwords are hashed with argon2id and a unique salt; we never store or see them in plain text.
- Sessions use a secure, HttpOnly cookie, and changing your password signs out your other devices. “Log out everywhere” in Settings does the same on demand.
- Repeated failed logins are slowed down, and password-reset links expire after an hour and work once.
- Links that carry secrets (password resets, invites, Slack account links) keep them out of server logs.
Application safeguards
- A strict content security policy, protection against cross-site request forgery, and no third-party scripts.
- Rate limits on logins, sign-ups, game joins and the API.
- Every piece of user text is cleaned of invisible and control characters, and never rendered as HTML.
- Question images load without telling the image's website which Drule page they're on, and Drule's servers never fetch them.
- Permissions are checked on the server for every request; other people's quizzes and reports simply don't exist to you.
Who can access data
Access to production systems follows least privilege: only [number / roles] can reach them, with individual accounts and multi-factor authentication [confirm]. We look at customer data only when you ask us to help, or when we must to keep the service safe.
Privacy by design
- Players never need an account. Anonymous mode stores no names, and results stay hidden until at least 3 people answer.
- Only one cookie — to keep you logged in. No trackers.
- Report retention settings delete old game results automatically, and anyone can export or delete their account in Settings.
Certifications
We don't hold a SOC 2 or ISO 27001 certification today, and we won't pretend otherwise. We're happy to answer your security questionnaire and to sign our data processing agreement.
Reporting a vulnerability
Found a vulnerability? Please email support@drule.app with the details and give us a chance to fix it before sharing it publicly. We'll reply within [3 business days] and won't take legal action over good-faith research that avoids harming users or their data.