Security at Opt2In

How we protect your data

• Minimization first. Report parsing runs entirely in the browser (or, in the iOS app, on the phone). We never receive raw exports, messages, photos, or synced contacts, we store no passwords, and we never touch bank or card numbers. What reaches us is an account record, the analyzed report summary a signed-in user saves, and payout records — itemized in privacy policy section 2.
• Encrypted in transit. HTTPS with TLS 1.2 or greater on every connection, to us and onward to every processor, with HSTS set so browsers will not downgrade.
• Encrypted at rest. Account records and saved reports are stored in Netlify Blobs, encrypted at rest with AES-256 or stronger. The underlying infrastructure is covered by Netlify's SOC 2 Type 2 and ISO 27001 reports.
• Authentication. Passwordless by design — Google, Apple, a one-time emailed link, or a 6-digit emailed code — so there is no password database to breach. Codes are stored only as SHA-256 hashes, expire in 10 minutes, burn after 5 failed attempts, and are single-use. Links carry 256 bits of entropy, expire, and are single-use. Sessions expire after 30 days.
• Authorization and access limitation. Every account endpoint re-validates the presented session token against the stored account record on each request; reads of a saved report additionally require the storage key to be scoped to the authenticated account, so a tampered request cannot cross accounts. Responses are serialized through an explicit field allow-list, which keeps session tokens, sign-in codes, and any field added in future off the wire by default rather than by memory.
• Abuse control. Per-address rate limits and request-size caps on sign-in, save, offer-click, survey, and AI-chat endpoints, each raising an internal alert when tripped, behind our host's automatic DDoS detection and blocking.
• Administrative access. Opt2In is a single-operator company and only that operator holds admin access. The admin console never stores its passcode in the browser — only a signed token expiring after 12 hours — and five failed attempts lock the originating address out for 15 minutes before any comparison is performed. Irreversible and money-moving actions require a second passcode entered per action and never cached. Production credentials exist only in our host's encrypted environment settings: never in the repository, never in client code. Provider accounts that can reach production require two-factor authentication.
• Release gates. An automated suite covering sign-in, payouts, offer handling, and retention runs before every deploy and blocks it on failure. A separate scanner reads every file the deploy would publish and fails the build if it finds a personal name, handle, local path, or credential.
• Deletion. Users delete a single saved report or the whole account themselves. Account deletion on the web is confirmed by email and reversible for 30 days, then hard-purged by a scheduled job; activity records are pruned at 180 days. Details in privacy policy section 9.

What we do not claim: Opt2In has not completed a SOC 2 or ISO 27001 audit of its own — those reports belong to the infrastructure we build on. Saved reports are encrypted in storage but not end-to-end; we can read them, because serving them back across devices requires it. We would rather state both plainly than imply otherwise.

Report a vulnerability

If you believe you have found a vulnerability in opt2in.com or its backend, this is how to reach us and what to expect. Machine-readable version: /.well-known/security.txt (RFC 9116).

In scope

• opt2in.com and opt2in.netlify.app — every page and asset we serve.
• Our backend functions under /.netlify/functions/ — authentication, report saving, payouts, email, and admin endpoints.
• The report engine itself: anything that would make an uploaded export leave the browser when it shouldn't, or expose one user's saved data to another.

Context worth knowing: report parsing runs entirely client-side by design — an uploaded Instagram export is processed in your browser and is not sent to our servers unless the user explicitly saves. A reproducible break in that property is exactly the class of finding we most want reported.

Out of scope

• Denial-of-service, volumetric, or rate-limit-exhaustion testing.
• Social engineering, phishing, or physical attacks on any person.
• Spam, or automated scanning that degrades the service for real users.
• Vulnerabilities in third-party platforms we use (Netlify, SendGrid, Tremendous, ConvertKit, Anthropic) — report those to the vendor's own program.
• Findings that require a victim's device or account to already be compromised.

Safe harbor

We will not pursue or support legal action against you for good-faith, non-destructive security research that respects the scope above: make a reasonable effort to avoid accessing other people's data, stop and report as soon as a vulnerability is confirmed, and give us reasonable time to fix the issue before any public disclosure. If you are unsure whether something is in scope, ask first at the same address.

Rewards

We do not currently run a paid bug-bounty program, and we would rather say that plainly than imply otherwise. We credit reporters who want credit, and we fix what you find.