Security

How we protect your account and data

• No passwords to steal. You sign in with a link we email you, which works once and expires after 15 minutes, or with Google. Only the browser that asked for a link can be signed in by it.
• Secrets are stored as hashes. Sign-in links and session tokens are kept as keyed hashes, so a copy of our database alone does not give anyone a working link or session.
• Sessions are locked down. Session cookies are HTTP-only, sent only over HTTPS and not shared across sites, and every change you make carries a separate anti-forgery token. You can sign out of every device from Settings.
• Everything is encrypted in transit. Beacon is served only over HTTPS with HTTP Strict Transport Security, and browsers are told not to allow it to be framed or to run scripts we did not issue (a strict Content Security Policy).
• We never see your card. Payments run on Stripe’s own pages. Beacon stores your plan and invoice amounts, not card numbers.
• We never ask for bank logins, credit reports or Social Security numbers. Figures you enter in a simulator or the net worth tracker are typed by you and stay in your account.
• Abuse is throttled. Sign-in, account and billing actions are rate limited, and each address can only be sent a few sign-in links at a time.
• Actions are recorded. Sign-ins, failed sign-ins and changes to an account are written to a security log, which is how we investigate a problem and how you can see your own history in your data export.
• Staff access is limited. Administrative tools check the role of the person on every request, not just in the screen they see, and access to production data is limited to the people who need it to run the service.
• No third-party trackers. Beacon loads no advertising, analytics or session-recording scripts, and serves its own fonts and images.

Who else touches your data, and for what, is on the Subprocessors page. What we keep and for how long is in the Privacy Policy.

If something goes wrong

If we learn that personal information we hold has been accessed or taken without authorization, we will investigate right away, stop it, and tell the people affected and any regulator the law requires us to tell, within the time the law sets. Organizations with a signed Data Processing Addendum are told within 72 hours of our becoming aware. No system is perfectly secure, and we do not claim otherwise.

Reporting a vulnerability

If you think you have found a security problem in Beacon, we want to hear about it, and we will not take action against you for finding and reporting it in good faith.

How to report. Email support@lighthousecompanies.pro with the subject “Security”. Tell us what you found, where, and the steps to reproduce it. A short proof is enough. Please do not post the problem publicly until we have had a reasonable chance to fix it. Our contact details are also published at /.well-known/security.txt.

What to expect. We will acknowledge your report within three business days, keep you informed while we investigate, and tell you when it is fixed. We are a small team and cannot offer payment for reports, but we will credit you if you want credit.

What is in scope. beaconapp.pro and the Beacon application behind it.

Please do not:

• access, change or delete anyone else’s data. If you reach someone else’s data by accident, stop and tell us;
• run denial-of-service, spam, brute-force or social-engineering attacks, or test physical security;
• use automated scanners that generate heavy traffic, or test third-party services we use (Stripe, Google, our hosting and email providers) rather than Beacon itself;
• keep or share data you reach beyond what is needed to show the problem.

Reports that stay within these rules are authorized: we will not bring or support legal action against you for them, and if someone else does, we will say that your report was made in good faith.