Security & transparency

Hosting model

Salahtime is operated as a self-hosted homelab service. Application servers and the primary database currently run on operator-controlled hardware rather than a multi-region commercial cloud. We do not claim bank-grade or SOC 2 datacentre isolation while hosted this way.

Controls in place

• Encryption in transit: public traffic is served over HTTPS.
• Encryption at rest: host disk encryption is required for production operation; database backups are encrypted with age before they leave the host.
• Admin MFA: the strict administrator account uses Google Authenticator–compatible TOTP. Sensitive admin actions require a short elevated session after MFA and are written to an audit log.
• Least privilege: default admin views avoid exposing account emails; privileged mutations are MFA-gated.
• No user-location analytics: we do not build country/city dossiers from account or map usage.

Retention (summary)

• Read in-app notifications: purged after 90 days.
• Anonymous client platform signals: purged after 90 days.
• Soft-deleted accounts: hard-deleted after 30 days.
• Admin security audit events: retained up to 24 months.

Incident contact

Report suspected security issues to [email protected].