Security and data

DemurrageCheck is operated by Tigran Avakov, a self-employed individual, Mirzo-Ulugbek 45A, 100007 Tashkent, Uzbekistan.

Passwords are hashed, and sign-in attempts are limited. Your password is stored only as a salted PBKDF2-SHA256 hash, never in plain text. After 10 wrong attempts in 15 minutes, password sign-in pauses for 15 minutes; the one-time email link still works. Changing your password signs you out on every other device. A link works once and expires after 15 minutes. Opening the link only shows a button; the sign-in happens when you press it, so a mail scanner that opens links does not sign in for you.

The session cookie is marked HttpOnly and Secure, is only sent to this site, and is renewed as you use the service. Signing out ends the session on our side.

Invoices are stored as files in object storage at Cloudflare, encrypted, with a separate key for each file. We do not upload invoices for you: a file is here because you sent it.

Reading an invoice sends the text of its pages to Anthropic, whose commercial terms do not allow it to train models on your files. Each item that comes back must be found in the text of the page, or it is not used. The privacy policy lists everyone who handles your data.

Within our own business, a reviewer may open an invoice file and what was read from it, to answer an item the reading could not settle or to repair a failed run.

The website loads no analytics, no advertising and no fonts from other sites. The payment pages, /billing and /pay, load the checkout script of Paddle (cdn.paddle.com), open its payment frame (*.paddle.com), and send requests to *.paddle.com; no other page of this website loads a script from another site. A strict content policy refuses anything that is not ours except what the payment pages load, and the pages that change something refuse a request that comes from another site.

We serve Geist and Geist Mono from our own domain. Loading these fonts does not contact a third-party font service.

Card payments are handled by Paddle. Card details never reach us.

Close a company yourself on its settings page: its files and data are deleted as the privacy policy describes. Or email support@demurragecheck.com from the address on the account.