Security, in plain words
Your ID, your location and your chats are some of the most sensitive things you have. This page says what protects them, what is still to come, and how to tell us if you find a problem.
Five layers, not one lock
No single control keeps a service like this safe, so we use several that back each other up.
You
ID check by a specialist partner
Government ID and a live selfie are checked by Stripe Identity. We receive the result, a reference, and the date of birth and sex shown on your ID, not copies of your ID or the selfie. Your email is confirmed with a code before your account works.
Your account
Passwords are never stored as typed
Passwords are scrambled with bcrypt before they are saved. Sign-in tokens are signed and expire. Repeated guessing is slowed by rate limits, and password resets need a code sent to your email.
Our servers
Every request is checked
Each input is validated, standard security headers are on, and secret keys live outside the code. The server refuses to start with a weak secret.
This website
Nothing third-party by default
A strict content policy blocks unknown scripts, pages load over HTTPS only, and analytics are off until you say yes.
People
A person reads every report
Report any message, plan or person in a tap, and block anyone. Several independent reports pause an account while our team looks; a person decides, in a console protected by a password and a one-time code, and every action is logged with a reason.
What is built in, and what comes before launch
We would rather tell you what is not finished than imply it is. This is the honest state of things.
| Protection | Status |
|---|---|
| Passwords hashed with bcrypt, signed sign-in tokens, rate limits on the API | Built in |
| Validation of every input; secrets kept out of the code; webhook signatures checked | Built in |
| Strict content security policy, HTTPS only, no advertising trackers on this site | Built in |
| Bot check on website forms (Cloudflare Turnstile) | At launch |
| Download or delete your whole account from the app | Built in |
| Email confirmation at sign-up, and password reset by emailed code; the same reply whether or not an address has an account | Built in |
| Exact meeting spots shown only to the host and accepted members | Built in |
| Automatic screening for slurs and strong profanity, report and block on every message | Built in |
| Moderation console with a password plus one-time code, and an append-only log of every action | Built in |
| ID check (Stripe Identity), safety text alerts (Twilio) and email (Resend) tested end to end with live accounts | Before we open the doors |
| Independent security test of the app and server by an outside specialist | Before we open the doors |
| Written plan for a security incident, including telling the ICO and affected people | Before we open the doors |
| Restore from backup tested, not just switched on | Before we open the doors |
| Two-step sign-in and endpoint protection on every device that can reach our systems | Before we open the doors |
Security is never finished and we won’t claim it is unbreakable. If something here changes, this page changes.
Keeping bots out of our forms
We use rate limits and, at launch, an automated bot check on our forms. Rate limits slow down anyone sending the same form over and over. The bot check is Cloudflare Turnstile: most people just see a tick or nothing at all, and only occasionally a short challenge. It is a security measure, not advertising. Once it is switched on, it is only loaded on pages with a form, and the privacy policy and cookie policy say what it involves. Until then, our website forms open a pre-filled email in your own email app, so nothing is sent until you send it.
How to protect your own account
- Use a password you use nowhere else, ideally from a password manager.
- We will never ask for your password, a verification code or a photo of your ID in a message. Anyone who does is not us. Report them.
- Keep your phone’s system and the app up to date.
- Only confirm details in the in-app chat. Be wary of links that someone you just matched with sends elsewhere.
- If you think your account was accessed by someone else, sign out everywhere and email security@goodcompanyapp.uk.
Found a security problem? Tell us
If you are a researcher or just someone who noticed something wrong, email security@goodcompanyapp.uk. Our machine-readable contact details are in security.txt.
What helps: a short description, the steps to reproduce it, and what you could reach. What we ask: only test with your own accounts, don’t access or keep other people’s data, don’t disrupt the service, and give us reasonable time to fix it before you publish.
We will reply within three working days. We act in good faith toward people who follow these rules. We don’t run a paid bounty programme.
Related
Safety covers meeting people in person. Your data lists everything we collect. For anything urgent about someone’s safety, see the emergency advice.