Security
Last updated: 15 November 2026
How Reportlume protects accounts and reports. No independent security certification or external audit is claimed.
Account protection
Sign-in sessions are verified on the server for every request. Signing out ends your session on the server and on all your devices. Repeated failed sign-in attempts are rate limited, and forms are protected against cross-site request forgery.
Isolation and private links
Each account can reach only its own clients and reports. Private report links use long random tokens; only a hash of each token is stored, and you can revoke a link at any time.
Data protection
All traffic uses HTTPS. Data is stored with Google Cloud, which encrypts it at rest. PDF exports are generated without loading any external resources.
Payments
Card details are entered only on the payment provider's checkout. Reportlume never receives or stores card numbers.
Testing
Automated tests, including real-browser tests for account isolation, form protection and upload limits, run on every change.
Sensitive data
Do not include payment cards, passwords or credentials in CSV uploads, notes or feedback. Reportlume does not ask for X login credentials.
Reporting a vulnerability
If you find a security issue, e-mail the contact address on this page. Please do not access other people's data while testing.
Seller
Shahin Aghasiyev, Azerbaijan
Contact: [email protected]