Small surface, plain controls.
Nodemeadow stores little, encrypts all of it, and keeps the number of systems that can see your thoughts as small as possible.
Data in transit and at rest
All traffic is HTTPS with modern TLS. Databases are encrypted at rest by the provider. Backups are encrypted and retained for 30 days.
Authentication
Email and password with bcrypt hashing at cost 12, or Google sign-in. Sessions are signed JSON Web Tokens with a 30-day life. Password resets and email verification use single-use tokens that expire within 24 hours.
Isolation
Every map query is scoped to the signed-in user at the database layer. Share links are random 128-bit tokens, read-only, and revocable. Model calls carry the fragments of one map and no identifiers.
Payments
Card details never touch our servers. Stripe handles checkout and stores payment methods. We keep only a customer id and a plan name.
Headers and rate limits
Strict content type, frame denial, referrer policy, and permissions policy headers are set on every response. Public endpoints are rate limited per network. Free tier limits are enforced server-side.
Reporting a vulnerability
Email security@nodemeadow.com with steps to reproduce. We acknowledge within two business days, fix critical issues within seven, and credit reporters who want credit. Please do not test against other people's accounts.