Security

This website

• The pages set no cookies of their own. Signing in to the console sets the cookies that keep you signed in, none used for analytics or advertising. The Early Access page uses an in-browser proof-of-work check and a 6-character email verification code, or lets you write to us in your own mail app.
• It loads nothing from any other website: it loads no analytics, fonts, scripts or chat widget from other websites.
• The console sign-in is on this website too, at /login.

Your organisation

• The record of withdrawals, requests, grievances and team actions is a per-organisation tamper-evident chain: each entry is cryptographically chained to the one before, with blockchain-anchored evidence and independent trusted time-stamps, so a later change shows in the DPO hash report and on the public verifier. It shows a change; it does not stop one.
• Each organisation sees only its own data. The checks that enforce this run on the server for every request.
• The sign-in is built into DPDP Star. We use no outside identity or captcha service. Codes and links are emailed through our Microsoft 365 mail service.
• Console sign-in needs your password and a code from your authenticator app; you get recovery codes when you set it up.
• An address is only attached to your organisation after you prove you control it.

To report a security problem, write to [email protected].