Skip to main content
Istibana
Back to home

Security Overview

Last updated: 15 October 2026

How Istibana protects your account, your surveys, and your respondents' data.

Authentication & access control

Sign-in uses short-lived JWT access tokens with rotating refresh tokens. Passwords are never stored in plain text — only as bcrypt hashes. The dashboard enforces role-based access control (RBAC): administrative actions require explicit permissions verified server-side on every request, never trusted from the client.

Encryption

All traffic between your browser and our servers is encrypted in transit with TLS. Data at rest lives in access-restricted databases; internal services communicate on an isolated network segment and are not reachable from the public internet.

Application safeguards

Defense-in-depth measures built into the platform:

  • Server-side validation on every write — client checks are never the only gate.
  • Rate limiting on authentication and submission endpoints, plus bot detection on public surveys.
  • CSV/spreadsheet exports neutralize formula injection (OWASP-recommended escaping).
  • Content-Security-Policy, HSTS, and clickjacking protections on the web app.
  • Respondent IP addresses are stored only as one-way hashes — and not at all for anonymized research surveys.

Backups & availability

Data is stored on durable, replicated infrastructure with regular backups. Deleting a survey removes it and its responses from the live system.

Responsible disclosure

Found a vulnerability? We want to hear about it. Email support@istibana.app with details and steps to reproduce; we'll acknowledge your report promptly and keep you informed as we fix it. Please do not access other users' data or disrupt the service while testing.