Draft for review. Fill in the company details and have a solicitor check this page, then set LEGAL_REVIEWED=1 to remove this notice.

Security

Last updated 17 October 2026

Found a problem? Tell us

Email security@getranka.com with what you found and how to reproduce it. We reply within 2 working days, keep you updated while we fix it, and credit you if you'd like.

Please test only against your own account, don't access or change other people's data, don't run denial-of-service or spam tests, and give us a reasonable time to fix the issue before telling anyone else. We won't take legal action against good-faith research that follows these rules.

How we protect your account

• Everything travels over HTTPS. Passwords are hashed with bcrypt; website passwords and webhook secrets are encrypted before they're stored.
• Optional two-step login with an authenticator app, with one-time recovery codes. Required for our own staff.
• Sign out of every device from Settings. Resetting your password does this too.
• Card details go straight to Stripe; we never see or store them.
• Every business's data is kept separate, every action checks who you are, and staff access to customer records is logged.
• Daily backups with point-in-time recovery, and restore drills.