How we protect your account
- Strong password storage. We never store your password. We keep only a one-way hash made with Argon2, a modern algorithm designed to resist cracking.
- Protection against guessing. After several failed sign-in attempts, an account is temporarily locked.
- Short-lived sessions. The app signs in with short-lived access tokens that are refreshed automatically. Changing your password signs you out everywhere else, and so does changing your email.
- Verified emails. We confirm your email address with a one-time code, and password resets use a one-time code sent to that address.
- Secure storage on your phone. The app keeps your sign-in in your phone’s secure storage (the iOS Keychain or Android Keystore).
How we protect your data
- Encryption in transit. All traffic between the app, this website and our servers uses HTTPS (TLS).
- Private files. Your uploads are kept in private cloud storage. Files are reached through links that expire after a short time, and only for your account.
- Isolation. Every request is checked against the signed-in account, so one person can’t reach another person’s notes.
- Least privilege. Only the people who need access to run Remi have it.
- Trusted providers. We use established infrastructure providers, listed in our Privacy Policy, that encrypt stored data.
- Deletion that means it. When you delete your account, your files are purged from storage and your data is removed from our database.
Tips to stay safe
- Use a unique password for Remi that you don’t use anywhere else.
- Keep your phone’s software up to date.
- We will never ask for your password by email or chat. If someone does, it isn’t us.
Reporting a vulnerability
If you believe you’ve found a security vulnerability in Remi, please tell us at security@remi-learn.com. Include a description of the issue, the steps to reproduce it, and its impact as you understand it.
When you report in good faith and follow this policy, we will:
- acknowledge your report within 3 business days;
- keep you updated as we investigate and fix it;
- not take legal action against you for your research; and
- credit you, if you’d like, once the issue is fixed.
Please:
- don’t access, change or delete data that isn’t yours. Use your own test accounts;
- don’t run denial-of-service tests, spam, social engineering or physical attacks;
- don’t use automated scanners that send large amounts of traffic; and
- give us reasonable time to fix the issue before sharing it publicly.
We don’t currently run a paid bug bounty program. Our contact details for researchers are also published in security.txt.
Questions about this document? Write to legal@remi-learn.com.