Passwords are stored only as bcrypt hashes — the original password cannot be recovered.
API keys are stored as a cryptographic hash; the full key is shown only once at creation.
Traffic between your browser and the Service is encrypted with TLS.
Databases and archive storage run on secured infrastructure with restricted administrator access.
2FA OTP codes and rate-limit counters are stored in Redis with a short TTL (minutes).

Retention periods

· Account data — while the account is active; up to 30 business days after a deletion request
· Order ZIP archives in the dashboard — 14 calendar days
· Administrator action logs — up to 90 days
· Transaction history — for the account retention period and accounting requirements