Security
Relationship data deserves better than most apps give it
What people write here is more sensitive than their bank balance. These are the controls that protect it, in plain English.
Encrypted everywhere
TLS 1.2+ in transit, AES-256 at rest. The database is hosted in the EU and encrypted by the provider; backups are encrypted too.
Separation between members
Every person has their own login and their own answers. No account can read another’s answers — the code enforces it, and an automated test suite plants private phrases and proves they never appear in anything shared.
Passwords
Hashed with bcrypt and never stored or logged in the clear. Sessions are HTTP-only, SameSite cookies, secure in production, and expire after 30 days.
A second lock
An optional privacy PIN on the coach chat, repair, journal and support pages, for shared devices.
Least privilege
The founder’s admin console shows statistics and what the coach wrote, and is technically prevented from showing anyone’s answers, notes, check-in text or chat. Every admin action is logged.
Rate limiting and abuse controls
Sign-in, forms, AI calls and public tools are rate limited. Public forms carry hidden traps for bots.
Kept only as long as needed
Published retention periods, applied automatically every day. Deleting your account removes everything keyed to you, table by table, and the test suite checks that.
Safe by default with AI
The coach receives only what it needs, its output is checked before anyone sees it, and the provider is contractually barred from training on your text and retains nothing.
Change control
Every change is version-controlled, type-checked, unit-tested and put through a full end-to-end suite ten times before release.
Reporting a vulnerability
If you think you’ve found a security problem, please email hello@sameside.co.uk with the words “security report” in the subject. Tell us what you found and how to reproduce it. We’ll acknowledge within two working days and keep you posted until it’s fixed. Please don’t access anyone else’s data, run automated scans against the live service, or publish details before we’ve had a chance to fix it — we won’t pursue anyone who reports in good faith and follows that.
If something does go wrong
We assess any suspected breach immediately. If it’s likely to risk people’s rights and freedoms we report it to the Information Commissioner’s Office within 72 hours, and if the risk is high we tell the people affected directly, in plain language, with what we’ve done about it.
Our information security management follows the structure of ISO/IEC 27001:2022. We are not certified to that standard, and we don’t claim to be — the policies, risk register and control mapping exist, but no auditor has signed them off.