Built secure, explained plainly.

Accounts and authentication

Passwords are hashed with Argon2 and never stored in a readable form. Nobody at Simulated Sphere can retrieve your password. A reset issues a new one rather than revealing the old.

• Sessions use a short-lived access token plus a refresh token held in an httpOnly cookie, which browser JavaScript cannot read
• Refresh tokens rotate on every use. Replaying an already-used token is treated as a theft signal, not a valid retry
• Optional two-factor authentication (TOTP, compatible with Google Authenticator) with single-use recovery codes
• Password reset links are single-use and expire in 30 minutes; a successful reset ends every other active session

Every opaque token we issue (refresh tokens, reset links, recovery codes) is stored only as a SHA-256 hash. The real value is shown once and is not retrievable afterwards, by us or by anyone who obtained a copy of the database.

Data in transit and at rest

All traffic to this site, our API, and our admin console is served over HTTPS/TLS. Databases and object storage are managed services with encryption at rest provided by the platform.

Secrets configured through the admin console, such as third-party API keys, are encrypted with AES-256-GCM before being written to the database, using a key held outside it.

Files and résumés

We keep two separate file stores, because not all files deserve the same treatment.

• Public store: blog cover images and avatars, intended to be publicly readable
• Private store: job applicants' résumés. This store has no public address at all. A résumé is reachable only through a short-lived, single-purpose link generated for an authenticated reviewer at the moment they open it

Uploads go directly from your browser to storage, so file contents never pass through this website's servers. Résumé size is checked server-side after upload and oversized files are deleted rather than accepted.

Payments

Payments are handled by Razorpay. Card numbers are entered into Razorpay's own checkout and are never transmitted to, processed by, or stored on our systems. We hold only the resulting order and payment identifiers.

Every payment is verified server-side by cryptographic signature before an order is treated as paid. A confirmation that fails signature verification is rejected, regardless of what the browser reports.

Protecting the application itself

• Rate limiting on authentication, password reset, and public form endpoints, enforced centrally so it survives restarts and applies across every server
• CSRF protection on every state-changing request using a double-submit token
• Bot protection on the contact form via Cloudflare Turnstile, plus server-side timing and honeypot checks
• Role-based access in the admin console, with permissions enforced on the server rather than only hidden in the interface
• The public site's server is the only client our API accepts public requests from; browsers never talk to it directly

What we do not claim

We would rather tell you where we are than imply more. As of the date above, Simulated Sphere Innovations holds no formal security certification, no ISO 27001 and no SOC 2, and has not commissioned an independent penetration test. We do not operate a paid bug bounty program.

The practices described on this page are real and can be discussed in detail. If your organization requires a certification, an audit, or a security questionnaire completed before working with us, contact us and we will tell you honestly whether we can meet it today.

Reporting a vulnerability

If you believe you have found a security issue, email security@simulatedsphere.com with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.

We will acknowledge your report, keep you updated on the fix, and credit you if you would like to be credited. We will not pursue legal action against anyone who reports a genuine issue in good faith and does not access or alter other people's data while finding it.

Questions

Security questions from prospective clients are welcome and we answer them directly. Reach us at security@simulatedsphere.com or through the contact form. For how we handle personal data specifically, see our Privacy Policy.