Skip to content

Security

In short

This page describes how Geoverio is built and operated: encryption in transit, API key handling, access control, backups and incident response. It is written to answer vendor security questionnaires directly, so a procurement or security team can start here instead of on a call.

Last reviewed 11 September 2026

Key facts

Password hashing algorithm
Argon2id
Two-factor options
TOTP or emailed one-time code
Session cookie setting
SameSite=Lax

A practical description of how the platform is built and operated. If you are filling in a vendor security questionnaire, this page is the place to start; anything not answered here, ask us.

Last updated: 28 July 2026

Report a vulnerability

Email [email protected]
Include enough detail to reproduce. We acknowledge within two business days and will keep you updated until it is resolved. Please give us reasonable time to fix an issue before disclosing it publicly, and do not access or modify other people's data while testing. We will not pursue legal action against researchers acting in good faith under these terms.

Authentication

  • Passwords are hashed with Argon2id and a server-side pepper, so a database copy alone does not yield credentials.
  • Two-factor authentication is available by authenticator app (TOTP) or by emailed one-time code. Recovery codes are stored hashed and shown to you once.
  • Failed sign-in attempts are rate limited per IP address and per account; those records are deleted automatically after two days.
  • Sessions use HttpOnly, Secure, SameSite=Lax cookies, and the admin area runs in a separate session cookie from the customer area.

API keys

  • Generated server-side, displayed once, then stored only as a hash alongside a short non-secret prefix so you can identify a key in your dashboard.
  • Scoped to a project, so you can separate environments and revoke one without affecting the others.
  • Optional IP restrictions per key.
  • Revocation takes effect immediately.
  • The documentation playground runs server-side with a restricted demo key — your key is never required by, or sent to, the browser.

Application security

  • All traffic over TLS, with HSTS (max-age one year, includeSubDomains).
  • Content Security Policy with a per-request nonce; no inline script without one.
  • X-Frame-Options: DENY and Referrer-Policy: strict-origin-when-cross-origin.
  • CSRF tokens on every state-changing form.
  • Parameterised database access throughout; output escaped by default in the template layer.
  • An audit log of security-relevant account actions.

Infrastructure

  • The API runs on dedicated infrastructure, separate from the website and dashboard.
  • Cloudflare sits in front of our web properties for TLS termination, caching and DDoS protection.
  • Card data never touches our servers — payments are handled by Stripe, which is PCI DSS Level 1 certified.
  • Encrypted backups with periodic restore testing.

Compliance status — stated plainly

We would rather tell you where we are than imply more.

ItemStatus
GDPR / UK GDPRAddressed. See the Privacy Policy and the DPA.
Data Processing AddendumAvailable, and signable on request.
Standard Contractual ClausesUsed for transfers out of the EEA and the UK.
PCI DSSOut of scope for us — card data is handled entirely by Stripe.
SOC 2 Type IINot yet held. If it is a requirement for you, tell us — it helps us prioritise.
ISO 27001Not yet held.
Penetration test reportAvailable to Enterprise customers under NDA.

Security questionnaires

Send yours to [email protected] and we will complete it. If you need an NDA first, we will sign one.

Frequently asked questions

How are passwords secured at Geoverio?
Passwords are hashed with Argon2id and a server-side pepper, meaning a database copy alone does not yield credentials. Two-factor authentication is available via authenticator app or emailed one-time code.
What happens if I find a security vulnerability?
Report it to the provided email address with enough detail to reproduce the issue. We acknowledge within two business days and will keep you updated until it is resolved.
Is card data processed on Geoverio servers?
No, card data never touches our servers as payments are handled entirely by Stripe, which is PCI DSS Level 1 certified. This keeps the API out of scope for PCI DSS.