Where Drule runs
Drule runs on servers in the European Union (Hetzner), behind Cloudflare. Backups are encrypted and stored in the EU. The full list of providers is on our subprocessors page.
Encryption
- TLS everywhere: every page, API call and live game connection is encrypted in transit, and browsers are told to always use HTTPS (HSTS).
- Encrypted backups of the database.
- Integration secrets — Slack tokens and Teams workflow URLs — are encrypted at rest with AES-256-GCM.
- No card data: payments happen on Paystack's checkout, so card numbers never touch our servers.
Accounts and passwords
- Passwords are hashed with argon2id and a unique salt; we never store or see them in plain text.
- Sessions use a secure, HttpOnly cookie, and changing your password signs out your other devices. “Log out everywhere” in Settings does the same on demand.
- Repeated failed logins are slowed down, and password-reset links expire after an hour and work once.
- Links that carry secrets (password resets, invites, Slack account links) keep them out of server logs.
Application safeguards
- A strict content security policy, protection against cross-site request forgery, and no third-party scripts.
- Rate limits on logins, sign-ups, game joins and the API.
- Every piece of user text is cleaned of invisible and control characters, and never rendered as HTML.
- Question images load without telling the image's website which Drule page they're on, and Drule's servers never fetch them.
- Permissions are checked on the server for every request; other people's quizzes and reports simply don't exist to you.
Who can access data
Access to production systems follows least privilege: only [number / roles] can reach them, with individual accounts and multi-factor authentication [confirm]. We look at customer data only when you ask us to help, or when we must to keep the service safe.
Privacy by design
- Players never need an account. Anonymous mode stores no names, and results stay hidden until at least 3 people answer.
- Only one cookie — to keep you logged in. No trackers.
- Report retention settings delete old game results automatically, and anyone can export or delete their account in Settings.
Certifications
We don't hold a SOC 2 or ISO 27001 certification today, and we won't pretend otherwise. We're happy to answer your security questionnaire and to sign our data processing agreement.
Reporting a vulnerability
Found a vulnerability? Please email support@drule.app with the details and give us a chance to fix it before sharing it publicly. We'll reply within [3 business days] and won't take legal action over good-faith research that avoids harming users or their data.