Security
How the production build is being designed to protect accounts and sensitive family administration.
Account security
- HTTP-only signed session cookies.
- Password hashing using scrypt with a unique salt.
- Optional authenticator-app two-step verification.
- Email verification and time-limited password-reset links.
- Same-origin checks for cookie-authenticated changes.
Document security
- Private per-person permissions enforced on the server.
- Strict file-type/content checks and blocked executable/script formats.
- Optional private ClamAV malware-scanning service.
- Application-level AES-256-GCM encryption before production object storage.
- Files are downloaded as attachments rather than trusted as executable web content.
Infrastructure
The live service uses HTTPS, secure session cookies, security headers, encrypted document storage and automated health checks. Access to sensitive records is checked on the server for every account and family role.
Auditability
Important account, sharing, document and sorting actions create structured audit events without intentionally copying document contents into the audit log.
Report a problem
Please contact hello@illsortit.app. Do not email passwords, authenticator codes or highly sensitive documents to support.
Where the live service runs
Primary live hosting: Sydney, Australia. I'll Sort It is operated from New Zealand and currently runs on Fly.io's Sydney region. The application database and uploaded files are stored on the attached persistent volume. Fly volumes are encrypted at rest, and stored document files also use application-level AES-256-GCM encryption.
The main service providers are Fly.io for hosting, Postmark for service email and Stripe for paid billing. See the Privacy Policy for the full data-handling explanation.