Security
Last updated: 30 October 2026. This page describes how ElevatePoint protects accounts and data today.
Encryption in transit
All traffic to elevatepoint.tech is served over HTTPS (TLS) with certificates from Let's Encrypt. Plain HTTP is not used for the application or the API.
Accounts and passwords
- Passwords are stored only as salted scrypt hashes, never in plain text.
- Every new account must confirm its email address with a one-time code before it can be used.
- Sessions use HttpOnly, Secure, SameSite cookies and expire after 30 days. Changing your password signs out your other sessions.
API keys
API keys are shown once at creation and stored only as SHA-256 hashes. You can delete a key at any time in the Developer API section.
Abuse prevention
- Every account has daily limits for verification, research and writing, plus platform-wide limits.
- Email verification uses rate-limited SMTP checks (one probe per second) and never sends an email.
- ElevatePoint does not send email from shared infrastructure on behalf of new accounts. Sending is enabled only after onboarding, from mailboxes the customer owns and approves.
Data processing
- Application data is stored in a database on our own servers hosted with OVHcloud.
- When you use research or writing features, the public website text of the company you entered is sent to a third-party AI model provider to generate the result.
- We do not sell data. Opt-out requests are honoured permanently.
Reporting a vulnerability
If you find a security issue, email nirav@elevatepoint.tech with the details. Please give us reasonable time to fix it before disclosing it publicly.