Security

We take the security of your account and data seriously. This page summarises the measures we use to protect the Service and how to report a vulnerability. RetroBoard is operated by Multistream Programming Ltd.

Authentication

We use passwordless, email-based authentication with one-time verification codes. Sessions are maintained using signed tokens stored in secure, HTTP-only cookies, which helps protect them from client-side scripts.

Data protection in transit and at rest

Traffic to the Service is served over HTTPS. Your data is stored in a managed PostgreSQL database with access restricted to the application.

Application safeguards

• Input validation and sanitisation to reduce the risk of injection and cross-site scripting;
• A Content Security Policy and standard security headers;
• Rate limiting on sensitive endpoints to mitigate abuse;
• Role-based access controls so only authorised participants can view or edit a board;
• Audit logging of sensitive actions.

Data lifecycle

Boards you archive are retained for 30 days and then permanently deleted, giving you a window to restore them. Deleting a board removes it and its associated content.

Your role in security

Keep access to your email account secure, since it is used to sign in. Only share board share codes with people you trust, and remove participants or archive boards you no longer need.

Reporting a vulnerability

If you believe you have found a security vulnerability, please contact us so we can investigate. Write to: Multistream Programming Ltd, Apollo House, Hallam Way, Whitehills Business Park, Blackpool, England, FY4 5FS. We ask that you give us a reasonable opportunity to address the issue before public disclosure.

This page describes our security practices in general terms and does not form part of a contract or warranty.