Governance, security and data

How we approach other people's data

DattaDock, LLC is a single member limited liability company in Oklahoma. It builds and runs its own web software. It takes no clients, resells nobody else's product and has no outside investment. That shape matters on a page like this: the number of people who can reach customer data is one, and the number of outside companies in the path of our products is five. All five are named further down, with what each one receives.

The working rule is to collect the least a product needs, keep it in as few places as possible, and be able to name every place it goes. Where a job is better done by a company that specializes in it, we hand the job over and say so on this page. Card details are the clearest case. They go to Stripe and never reach our servers.

One scoping note before the list below. The security measures we describe are verified live on Classic Source, the product that has accounts, sign in and billing. We list them that way, tied to a product you can check, rather than claiming a single blanket standard across everything we run.

Security measures in place

Strict Content Security Policy

The browser is told exactly which scripts and styles are allowed to run on the page, so scripts and styles from sources the policy does not list are blocked by the browser. It limits what an injection can do rather than removing the risk.

HSTS with preload

The browser is required to use an encrypted connection, and that rule ships inside the browser in advance, so even a first visit cannot be pushed down to unencrypted HTTP.

X-Frame-Options: DENY

The site cannot be loaded inside a frame on someone else's page. That blocks clickjacking, where a hidden layer collects clicks the visitor meant for something else.

X-Content-Type-Options: nosniff

The browser must treat each file as the type the server declares it to be, so an uploaded or fetched file cannot be guessed into running as a script.

Permissions policy

Declares that browser features the products do not use, including camera, microphone, geolocation and payment handlers, are not permitted. It narrows what a compromised page could ask the browser for.

Passwords stored as scrypt hashes with a random salt

Passwords are never stored. Each one goes through scrypt, a deliberately slow calculation, with its own random salt, so a stolen database does not expose passwords directly, and guessing them is slow and expensive.

Session tokens stored as SHA-256 hashes

Only a hash of a session token is kept on the server, so the stored value cannot be replayed as a session token on its own.

API keys held server side only

Keys for Stripe, Anthropic and the rest stay on the server and are never sent to the browser, so they cannot be read out of a page or a network request.

Payments and money movement

Paid plans are billed through Stripe. Card details are typed into Stripe's own payment fields and travel to Stripe directly. They never reach a DattaDock server, are never written to our database and are never logged. We can see that a subscription exists and whether a charge succeeded. We cannot see a card number, and we could not produce one if asked.

No product moves customer money. Kinlend produces a written agreement for a loan between two people who already know each other, builds a payment schedule with reminders and records what has been paid. The money itself passes directly between those two people by whatever method they choose. Kinlend is a record keeping tool. It is not a lender, it is not a money transmitter and it holds no customer funds.

Ledger works out who owes whom across a shared household, a trip or a couple, and reduces that to the fewest payments needed to settle up. It calculates. It does not move money either.

Service providers and what each one receives

• Netlify

  Used by every product

  Hosting and application runtime. Every page and every server function runs on Netlify, so it necessarily sees traffic to the products and holds what those products save.

  Receives: all web traffic, request logs, and the data our applications store.

• Stripe

  Paid plans only

  Payments and subscriptions. Card details go from the customer's browser to Stripe directly. Anyone on a free tier, and any product with no paid plan, never touches Stripe at all.

  Receives: card details, billing name and email address, for customers on a paid plan.

• Anthropic

  AI features only

  The AI functions inside our products call Anthropic's API and return the answer. Only the content needed for that one request is sent, and nothing is sent when the feature is not in use.

  Receives: the text sent to an AI feature at the moment that feature runs.

• Google Sign-In

  Optional, some products

  An alternative way to sign in, offered alongside email and password and never as the only route in. If you sign in with a password instead, Google is not involved.

  Receives: the sign in attempt. Returns to us the account details needed to identify you, which are listed in the consent screen Google shows before you approve it.

What we do not do

• No advertising trackers and no ad networks anywhere in our products.
• No third party analytics scripts running in the page.
• We do not sell or rent personal data, to anyone, at any price.
• Customer data is not used to train AI models.
• We do not add a service provider without listing it on this page. The four above are the complete set of companies that receive customer or account data. TradeXP also draws its job listings from the Adzuna API, which supplies data to us and receives no customer data.

Reporting a security problem

Send security reports to info@dattadock.com with Security in the subject line. Every product is covered by that one address.

Include the product name, the URL, what you did and what happened. A short set of steps someone can follow is far more useful than an automated scanner report.

Reports go straight to the company. You will get a reply confirming receipt and saying what happens next. Because there are no employees, that is a target rather than a guarantee, and security reports are read ahead of everything else.

Two requests while you look. Please do not test in a way that degrades a live service or reaches another person's account or data, and please give us a reasonable chance to fix a problem before you publish it.