Security

Last updated: October 2026

We take the security of your data seriously. This page describes the measures we have in place to protect your account, your generated websites and your personal information.

Infrastructure

• Hosting. OnePageForge runs on Cloudflare Workers, a serverless platform distributed across Cloudflare's global network. There are no traditional servers to patch or maintain.
• Database. Your data is stored in Cloudflare D1, a serverless SQL database that runs at the edge. Data is encrypted at rest by Cloudflare.
• TLS. All connections to OnePageForge are encrypted with HTTPS (TLS 1.2 or higher). HTTP requests are automatically redirected to HTTPS.
• DDoS protection. Cloudflare provides automatic DDoS mitigation at the network and application layers.

Authentication

• Password hashing. Passwords are hashed using PBKDF2 with 100,000 iterations and a unique random salt per account. We never store passwords in plain text.
• Session management. Sessions are managed with HttpOnly cookies that cannot be read by client-side JavaScript. Session tokens are generated using cryptographically secure random bytes.
• CSRF protection. All mutating API requests are protected with same-origin checks. Requests from different origins are rejected.

Payments

• Stripe. Payments are processed entirely by Stripe. Card details are entered on Stripe's PCI-compliant checkout page. We never see, handle or store your full card number, CVV or billing address.
• Webhook verification. Stripe webhook events are verified using the webhook signing secret before we act on them. Unverified events are rejected.

Data handling

• Minimal collection. We collect only the data necessary to operate the service: your name, email, hashed password, generated websites and payment references.
• Account deletion. You can delete your account from your account page. This permanently removes your profile, generated websites and all associated data.
• Data retention. We keep your data for the duration of your access period plus 30 days. After that, your generated websites and account data are deleted.

Access controls and monitoring

• Least access. Access to production configuration and customer data is limited to the people who need it to run the service, and admin functions are restricted to approved administrator accounts.
• Isolation. Each customer can only read, list and delete their own generated websites and account data.
• Logging. The platform records request and error logs so that suspicious activity and failures can be detected and investigated. Passwords and payment details are never written to logs.
• Updates. We review dependencies and apply security patches to the software we run.

Your responsibilities

Security is shared. Choose a strong, unique password, do not share your login, sign out on shared devices, and tell us straight away if you think your account has been accessed by someone else. See our Privacy Policy for how we handle your data.

Rate limiting

API endpoints that accept user input (contact form, generation requests) are rate-limited to prevent abuse. Excessive requests result in temporary blocks.

Responsible disclosure

If you discover a security vulnerability in OnePageForge, please report it to support@onepageforge.com with the subject line "Security Report". We ask that you:

• Do not exploit the vulnerability beyond what is needed to demonstrate it.
• Do not access other users' data.
• Give us reasonable time to fix the issue before disclosing it publicly.

We appreciate your help in keeping OnePageForge safe.

Contact

Security questions? Email support@onepageforge.com.