Keeping your cards and leads safe.

Reporting a vulnerability

If you think you’ve found a security problem in Fronko, please email [email protected] with the steps to reproduce it. We’ll acknowledge your report, keep you updated while we fix it, and credit you if you’d like.

While you investigate, please:

• only use accounts and organisations you own or have permission to test;
• don’t access, change or delete other people’s data, and stop as soon as you see any;
• don’t run denial-of-service attacks, spam, or social engineering against our staff or customers;
• give us reasonable time to fix the problem before you tell anyone else.

We won’t take legal action against research done in good faith within these rules. Our security.txt has the same details.

Your data

• Encrypted in transit. Every connection to Fronko uses HTTPS, with HSTS so browsers never fall back to plain HTTP.
• Secrets encrypted at rest. Integration tokens, API keys and other secrets are encrypted with AES-256-GCM and are never shown again after you save them.
• Private files. Photos and documents are kept in private storage and open only through links that expire after a short time.
• Organisations are kept apart. Every request is checked against the organisation and role of the person making it; members see only their own cards and leads.
• No staff access to your content. Our admin tools show totals, such as how many cards an organisation has, never card contents or leads. Staff sign in with two-factor authentication, and everything they do is logged.

Accounts

• Passwords are stored only as bcrypt hashes; sign-in and reset are rate limited.
• Sessions live in secure, HttpOnly cookies, and changing your password signs out every other session.
• Single sign-on (SAML) with your identity provider, optional enforcement for your whole team, and SCIM to remove people the moment they leave (Enterprise).
• Email addresses are verified with one-time codes before an account can be used.

Built in

• Requests to addresses you enter, such as webhooks, are checked after DNS resolution, so they can’t reach private networks.
• Webhooks can be signed so your receiver can check they came from Fronko.
• Strict security headers, protection against cross-site requests, and per-address rate limits.
• Public cards set no cookies and use no third-party scripts.

Privacy

We process your organisation’s data only to run the Service, under our Data Processing Agreement. See the Privacy Policy and the subprocessors we use.

Payments

Payments are handled by Paddle, our merchant of record, which is PCI DSS compliant. Card details are entered in Paddle’s checkout and never reach Fronko.