Security

1. Our Approach

Security is designed into GOAL API rather than bolted on: credentials are never stored in a recoverable form, payments never touch our servers, and every administrative action is logged. This page describes the concrete measures protecting your account, your keys and your data. We only list what is actually implemented.

2. Encryption in Transit

All traffic between you and GOAL API — the website, the dashboard and every API request — is encrypted with TLS. Connections are fronted by Cloudflare, which also absorbs volumetric attacks before they reach our infrastructure.

3. Credentials and API Keys

Nothing that grants access to your account is stored in a form we (or an attacker) could read back.

• •Passwords are hashed with bcrypt — never stored or logged in plain text
• •API keys are stored only as irreversible hashes; the full key is shown once, at creation
• •Two-factor authentication (TOTP) is available for your account
• •Repeated failed sign-ins lock the account temporarily and are recorded
• •Session tokens are versioned, so a password change invalidates existing sessions

4. Payments

Card data never touches our servers. Payments are processed entirely by Stripe, a PCI DSS Level 1 certified provider: you enter card details on Stripe's own checkout page, and we store only the subscription state and invoice references.

• •No card numbers, expiry dates or CVCs are ever received or stored by GOAL API
• •Billing events from Stripe are accepted only with a valid cryptographic signature
• •Plan changes state their exact cost and require explicit confirmation before any charge

5. Platform Protections

The API itself is defended against abuse and misuse:

• •Per-plan rate limits and quotas, enforced on every request
• •Abusive request patterns are detected and can be blocked automatically
• •Administrative access is role-restricted, protected by two-factor authentication, and every admin action is written to an immutable activity log
• •Destructive operations require explicit typed confirmation and are restricted to the highest privilege level

6. Data Protection and Backups

Your data is protected against loss as well as against intrusion.

• •Automated daily database backups with a 30-day retention window
• •Backups are integrity-verified at creation time
• •Deleting your account permanently removes your personal data and everything attached to it (see the Privacy Policy for retention details)

7. Reporting a Vulnerability

If you believe you have found a security vulnerability in GOAL API, please report it to us at [email protected] with enough detail to reproduce the issue. We ask that you give us reasonable time to remediate before any public disclosure, and that you avoid accessing other users' data while investigating. We do not take legal action against good-faith security research conducted under these terms.