Security & Privacy

Infrastructure

Data residency

All user data (accounts, polls, responses, attachments) is stored exclusively in the European Union on Hostinger's EU VPS infrastructure. Data does not leave the EU except for:

• Cloudflare analytics - anonymised, aggregate traffic metrics only (no PII).
• AI features - poll content or chat messages may be sent to our AI provider (OpenRouter) for poll generation, branching logic, or the Pulse AI chat assistant. No voter response data is sent.

Encryption

• In transit: TLS 1.2+ enforced at Cloudflare edge for all HTTP and WebSocket connections. HSTS is set with a 1-year max-age.
• At rest: PostgreSQL volume is encrypted by the VPS provider's block storage. Database backups are encrypted before upload.
• Passwords: Stored as Argon2id hashes (m=19456, t=2, p=1). Legacy bcrypt hashes are transparently upgraded on next successful login. Plaintext is never stored or logged.
• Reset / verify tokens: Password-reset and email-verification tokens are stored as SHA-256 hashes only. The raw token exists solely in the emailed link.
• API secrets: API keys and OAuth client secrets are stored as SHA-256 hashes. Plaintext is shown exactly once at creation and never stored.
• Webhook secrets: HMAC-SHA256 signing secrets are stored encrypted. Every outbound webhook payload is signed.

Authentication

PollsLive supports two sign-in methods:

• Google OAuth - uses the official Google identity provider. We request only email and profile scopes.
• Email + password - passwords are Argon2id-hashed. Password reset is via a time-limited, single-use token sent to the registered email.

Sessions are JWT-based (NextAuth.js), signed with NEXTAUTH_SECRET. Sessions last 30 days (the NextAuth default) and renew while you stay signed in. Password changes invalidate existing JWTs via passwordChangedAt.

Login attempts are throttled per email and per IP (8/email, 40/IP per 15 min) with timing-safe dummy bcrypt to prevent user enumeration. Accounts can be banned for Terms of Service violations.

API security

• Bearer token auth - all /api/v1/ routes require a valid API key (plv_live_…) or OAuth 2.0 access token (plv_oauth_…).
• Constant-time comparison - token validation uses crypto.timingSafeEqual to prevent timing attacks.
• Rate limiting - 120 requests/min per API key; 30/min for media ingestion. Limits enforced by Redis; in-memory fallback on Redis outage.
• CORS - /api/v1/ does not set permissive CORS headers; cross-origin access requires an API key.
• CSRF - mutation routes use NextAuth's CSRF token; public voting routes require Turnstile for cookieless voters.
• Input validation - all request bodies are validated with Zod schemas before processing.

See Rate limits & errors for full details.

Application hardening

Beyond infrastructure and API controls, the application layer enforces:

• Workspace access control - polls and workspace resources require authenticated membership or an explicit guest token. Public results use dedicated, gated routes.
• Outbound URL safety - user-configured webhooks and lead destinations must use HTTPS and are checked against private and reserved address ranges.
• Bot protection - sensitive public routes (voting, guest poll creation, contact) require Cloudflare Turnstile verification in production.
• Security headers - CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Cross-Origin-Opener-Policy, and no X-Powered-By leakage.
• Dependency hygiene - dependencies are scanned regularly; known issues are patched through our normal release process.

GDPR compliance

PollsLive is designed for GDPR compliance from the ground up:

• Data export - download all your data (account, polls, responses) in JSON from Studio → Settings → Export data.
• Account deletion - permanently deletes your account, workspace, polls, and all associated data with a single confirmation step.
• Cookie consent - cookies are categorised (Necessary, Analytics, Preferences). Analytics cookies are only set after consent.
• Voter anonymity - poll voters are identified only by a browser fingerprint (non-persistent, non-identifying). No voter PII is collected unless the voter voluntarily provides a display name.
• Data processing agreement - available on request for Enterprise customers. Contact our team.

Abuse & moderation

Public polls can be reported for abuse via the Report button on every poll page. Reports are reviewed by the PollsLive team. Confirmed policy violations result in the poll being taken down and the workspace being suspended.

Live session Q&A supports presenter-side moderation - all questions are held for approval before appearing on-screen when moderated: true is set.

Edge IP bans (automatic scanner detection + manual admin bans) are synced to nginx on a cron schedule. Auth abuse reports are tracked in the admin security dashboard.

Enterprise documentation

We do not publish detailed security audit reports on the public internet. If your procurement or security team needs a written overview of our controls, data residency, and review practices, contact our team (Enterprise sales or Privacy / GDPR). We can share a security summary under NDA for qualified enterprise evaluations.

Responsible disclosure

Found a security vulnerability? Please report it privately via our contact form (select Security / Bug report). We aim to respond within 72 hours and will credit researchers in our changelog after the issue is resolved.

Please do not publicly disclose vulnerabilities before we have had a chance to patch them.