Security
Built with Data Security in Mind
We believe that protecting access to analytical workspaces and handling user information responsibly are essential parts of a reliable software experience. This page lists the controls that are actually in place.
Secure Account Access
- Passwords are hashed with scrypt, a memory-hard algorithm. We never store or e-mail your password.
- Sign-in sessions use random 256-bit tokens. Our database stores only a SHA-256 hash of each token.
- Session cookies are httpOnly (not readable by page scripts) and SameSite=Lax, and expire after 30 days.
- Sign-in, sign-up, password reset and contact forms are rate limited to slow down automated attacks.
- Activation and password-reset links are single-use and expire (48 hours and 1 hour respectively).
- Paid access is verified on our server for every request — it cannot be unlocked by changing anything in the browser.
Secure Data Transmission
- All traffic in production is served over HTTPS, with HTTP Strict Transport Security (HSTS) instructing browsers to never use an unencrypted connection.
- Security headers are sent with every page: Content-Security-Policy, X-Frame-Options: DENY (prevents clickjacking), X-Content-Type-Options: nosniff and a strict Referrer-Policy.
- State-changing requests are checked for same-origin, in addition to SameSite cookies, as a defence against cross-site request forgery.
Data Management
- Uploads are validated on the server: only CSV and JSON files are accepted, up to 5 MB, 50,000 rows and 100 columns.
- The parsed table is stored in our PostgreSQL database and linked to your account. The original file is not kept.
- Every dataset, analysis and report request is authorized on the server against your account, so data is isolated between accounts.
- Statistical calculations run in your browser; datasets are not sent to external analytics services.
- CSV exports neutralize spreadsheet formulas (cells starting with =, +, - or @) to prevent formula-injection attacks when opened in spreadsheet software.
Payment Security
- Payments are completed through Mundpay's checkout environment. EuroData Score does not directly collect or store full payment card details.
- Access is granted only after Mundpay notifies our server that a payment was confirmed. Browser redirects and URL parameters are never accepted as proof of payment.
- Each payment notification is recorded once, so duplicate notifications cannot grant or revoke access twice.
Privacy Controls
- Delete any dataset instantly from the Datasets page.
- Export a copy of your account data (JSON) from Settings.
- Delete all workspace data, sign out of all sessions, or permanently delete your account from Settings.
- Uploaded data is never sold, never used for advertising and never used to train AI models.
Responsible Security Practices
- Security-relevant account events (such as account creation and changes to access) are written to an audit log.
- Logs are designed not to record passwords, tokens, payment data or dataset contents.
- Secrets such as API keys are kept in server-side environment variables and are never sent to the browser.
- All input is validated on the server, and the interface escapes user content to prevent cross-site scripting.
What we do not claim
Transparency matters as much as the controls themselves.
EuroData Score does not currently hold ISO 27001, SOC 2 or PCI DSS certifications, and has not undergone an independent security audit. Payment card data is handled by Mundpay, not by our systems. No online service can be guaranteed to be completely secure.
Report a vulnerability
If you believe you have found a security vulnerability, please e-mail support@eurodatascore.com with a description and steps to reproduce. Please do not access other users' data, degrade the service or publicly disclose the issue before we have had a chance to fix it.
More about how we handle data: Privacy Policy · Cookie Policy
Clear insights start with better analysis
EuroData Score — Full Access is a one-time payment of €42. No subscription, no recurring charges, and a 60-day money-back guarantee.