Security & privacy
Your data is locked down — even from a database leak.
Private details are encrypted before they ever reach our database, passwords are never stored, and every sign-in needs a code from your email. Here is exactly how it works.
- Encrypted at rest256-bit XChaCha20-Poly1305
- 2-step sign-inNew emailed code every time
- Argon2id passwordsPlus a secret pepper
- Separate serversAccounts isolated from reviews
What we encrypt
| Data | Protection | Details |
|---|---|---|
| Email address | Encrypted | XChaCha20-Poly1305, 256-bit key. Looked up with a keyed fingerprint, never in plain text. |
| Display name | Encrypted | Decrypted only to show it next to your reviews. |
| Password | Never stored | Only an Argon2id hash of a secret-keyed “pepper” — it can’t be reversed. |
| IP addresses | Encrypted | Kept only in your security log on the account server, deleted after 90 days. Reviews store no IP at all. |
| Browser information | Encrypted | Kept only in your security log. |
| Sign-in session | Encrypted | Session contents encrypted; the session ID is stored only as a keyed hash. |
| Your location | Encrypted | Only when you tap “Use my location”, inside your encrypted session — never saved to your account. |
| Sign-in codes | Hashed | Stored as a keyed hash, expire in 10 minutes, single use. |
| Username, reviews, ratings | Public | Shown on the site by design, so they are stored as written — but always safely escaped. |
Encryption keys live outside the database, in the server’s private configuration. Each value is sealed to its own column, so encrypted data can’t be copied from one place to another, and any tampering is detected. Keys can be rotated without downtime.
Your account is kept apart from reviews
RestRating stores data on two separate database servers, each with its own login and encrypted connection:
Account server
Your email, name, password hash, sign-in codes, sessions and security log — all encrypted.
Platform server
Places and reviews. No emails, names, IP addresses or account IDs — each review carries only a random code.
Only the website can connect a review’s random code to an account. So if someone ever broke into the platform server, they would find reviews but no way to tell who wrote them — and the account server holds nothing but encrypted personal data. The software also refuses any database query that tries to combine the two.
Attacks we block
SQL injection
Every query uses server-side prepared statements with bound values; stacked queries are disabled, SQL text containing ; or comments is refused, and the database runs in strict mode.
Cross-site scripting (XSS)
All output is HTML-escaped, and a strict Content-Security-Policy allows scripts only from RestRating itself — no inline scripts. Violations are reported to us.
Cross-site request forgery
Every form carries a secret token, and we also reject submissions that come from another website.
Brute-force & credential stuffing
Rate limits per network and per account, a 15-minute lock after repeated wrong passwords, and an emailed code at every sign-in.
Session hijacking & fixation
Secure, HttpOnly, SameSite cookies; new session ID at sign-in; sessions tied to your browser; idle time-out; “sign out other devices”.
Clickjacking
Pages can’t be framed by other sites.
PHP & server exploits
Only one PHP entry point can be reached; private folders, config and backups are blocked; uploads can’t run as code; errors are never shown to visitors.
Spoofing & hidden characters
Invisible and right-to-left override characters are stripped from names and reviews; email headers and redirects are validated.
What we keep, and for how long
- Security log (sign-ins, failed attempts): 90 days, then deleted.
- Sign-in codes: expire after 10 minutes; records deleted after 2 days.
- Reviews never store your IP address, email or account ID.
- Sessions: end after 120 minutes without activity.
- We never sell or share your personal data.
You’re in control
From your account you can see recent sign-ins, sign out every other device, download all of your data, or permanently delete your account.
Report a security problem
Found a vulnerability? Please email security@restrating.com with the details and give us a reasonable time to fix it before sharing it publicly. Please don’t access other people’s data or run denial-of-service tests. We’ll reply within 5 business days and credit you if you’d like. Our contact details are also published at /.well-known/security.txt.