Skip to content
Client area
EN
Request a demo
Security

What protects your sessions, in practice.

A session brings together your teams, their answers and sometimes their photos. Here are the protections in place, without jargon, and how to check them yourself.

HTTPS everywhereThe site, the client area and every session are encrypted, on computers and phones alike.
No third-party servicesNo advertising trackers, no external analytics: fonts and scripts are served by our own servers.
One instance per clientEach session runs on its own, at its own address, with its own data: nothing is shared between two clients.

Encryption

Every page, the client area and the game sessions go through HTTPS. Certificates are issued by Let's Encrypt and renewed automatically. Exchanges between participants' phones, the projected screen and the server are encrypted the same way.

Hosting

Our servers are rented from netcup GmbH, in Germany, in ISO 27001-certified data centres in the European Union, under a GDPR-compliant processing agreement. Details are on the Privacy and hosting page.

The server

The server is administered only with a cryptographic key: no password login is possible. A firewall closes everything that is not needed, repeated attempts are blocked automatically, and security updates install themselves.

Sessions

Each order becomes a dedicated instance. The facilitator runs the session with a six-digit code specific to that instance, read in the client area: it is never sent by email. Participants join the game by scanning a card, with no account or email address to give.

Accounts

In the client area, passwords are at least twelve characters long and stored hashed (scrypt, with a salt unique to each account): nobody, not even us, can read them. Repeated login attempts are blocked, and links sent by email (account creation, new password) work only once and expire. Our internal dashboard requires two-factor authentication or a passkey.

Forms

Our forms check phone numbers and email addresses, limit the number of submissions per connection and keep robots out. Uploaded files (CV, logo, brand guidelines) are checked: their format and size.

Data

We collect only what is strictly necessary, and a session's data is deleted thirty days after the event. Site analytics work without cookies, from our own logs, with truncated IP addresses. The database is backed up every night, with an integrity check.

Check for yourself

These free public tests analyse the site live, without asking our opinion:

Report a vulnerability

Think you have found a security vulnerability? Write to us at contact@corporatesolutions.live with “Security” in the subject. We acknowledge receipt within three working days and keep you informed of the fix. Please do not make the vulnerability public before it is fixed, and never access other people's data. Our security contact details are also published in security.txt.