Security

How we protect your account

• Passwords are stored as salted bcrypt hashes, never in plain text or reversible form.
• Sessions use opaque random tokens; only a SHA-256 hash is stored, so a database leak alone cannot be replayed as a login.
• Session cookies are httpOnly and SameSite=Lax, and are marked Secure in production.
• Sign-in, registration and password-reset endpoints are rate limited.
• Sign-in errors never reveal whether an email address is registered.
• A password reset invalidates every existing session.
• You can see and revoke signed-in devices from Account → Security.

How we protect the platform

• Every input is validated server-side against a schema; client-side validation is a convenience, never the control.
• Prices and totals are recomputed on the server at checkout — the browser’s figures are never trusted.
• Authorisation is checked per request, and admin routes are role-protected at the layout level.
• Security headers are set, including a content security policy, frame denial and MIME-sniffing protection.
• Card details are never stored; only the brand and last four digits are retained.

Reporting a vulnerability

Report through the Help Centre with enough detail to reproduce. Please do not access other people’s data while testing, and give us a reasonable window to fix the issue before disclosing it publicly.

What we do not claim

Pickovia makes no compliance certification claim on this page. Any PCI DSS, ISO 27001 or SOC 2 statement would require a formal audit first.