Security
Security and data protection
How we protect your account, your API keys and your money. Plain facts, no badges.
Your account and keys
Only a SHA-256 hash of each API key is kept. The key is shown once; nobody at TickFeed can read it back.
A slow, salted password hash designed to resist cracking. Passwords are never logged or emailed.
Email confirmation, rate limits and a temporary lockout after repeated failed attempts. Sign-in cookies are HttpOnly and only their hashes are stored.
Revoke or rotate keys and sign out other sessions from your dashboard at any time.
Payments
Top-ups are processed by Stripe, a PCI DSS Level 1 payment provider. Card numbers go straight to Stripe and never touch our servers. Every top-up has a Stripe invoice and receipt, and refunds of unused balance go back to the original card.
In transit
Every connection to tickfeed.pro and api.tickfeed.pro uses HTTPS with HSTS. Pages ship a strict Content Security Policy, and the dashboard checks the origin of every form it accepts.
Infrastructure
Administrative tools are not reachable from the internet. The database is backed up every day and checked for integrity, and the service is monitored around the clock with automatic alerts. History of every incident is on the status page.
What we keep, and for how long
Your email, account settings and billing records, as needed to run the service and meet tax rules. API request logs are deleted after about 13 months, expired sign-in sessions and email codes within a day, and closed support tickets after two years. Details are in the privacy policy.
Reporting a vulnerability
Found something? Email [email protected] with what you found and how to reproduce it. We reply within one working day, keep you updated while we fix it, and won't take action against good-faith research that avoids harming users or their data. Our security.txt has the same details.
Frequently asked questions
Does TickFeed store my card details?
No. Payments are handled by Stripe. Card numbers go straight to Stripe and never reach our servers.
How are API keys stored?
Only a SHA-256 hash of each key is stored. The full key is shown once when you create it, so we cannot show it again or leak it; if you lose it, revoke it and create a new one.
How do I report a security issue?
Email us with the details and steps to reproduce. We reply within one working day and won't take action against good-faith research. See /.well-known/security.txt.