Do you store my contact list?

No. Contacts, companies, campaigns and drafts are stored in your browser using IndexedDB and are never transmitted to our servers.

Do you use third-party trackers?

None. No analytics, no advertising, no tag managers and no external fonts. The Content-Security-Policy allows this origin only.

Has the code been independently audited?

No. Nobody outside the team has reviewed it, and we would rather say so than imply otherwise.

Security

Your list is yours, and stays where you put it

Q: How are my SMTP and API credentials stored?

Encrypted with AES-256-GCM and held outside the web root. They are never sent to the browser and never appear in a page, a log or an error message.

Q: How are passwords stored?

Hashed with bcrypt. Nobody can read them back. A password issued by an administrator must be changed at first sign-in.

The most useful security property of StarlineSales is architectural: your contacts are never uploaded, so there is no central store of everyone's prospect lists to be stolen.

Your contact list never reaches us

Contacts, companies, campaigns, drafts and history are stored in your browser's own database. They are not transmitted to our servers, so they are not in our backups and cannot be exposed by a breach of ours.

Credentials encrypted at rest

SMTP passwords and API keys are encrypted with AES-256-GCM and stored outside the web root. They are never sent to the browser and never appear in a page, a log or an error message.

Passwords are hashed, never stored

Account passwords are hashed with bcrypt. Nobody — including us — can read them back. A password issued by an administrator must be changed at first sign-in.

HTTPS everywhere, enforced

The site is HTTPS-only with HSTS set for a year. Session cookies are Secure, HttpOnly and SameSite=Lax, and the session identifier is regenerated on sign-in.

A strict content security policy

Scripts and styles load from this origin only. No third-party analytics, no tag managers, no advertising pixels, no external fonts. There is no inline script anywhere in the product.

Everything security-relevant is logged

Sign-ins, failures, sign-outs and every account change are recorded with the actor, the subject, the time and the address. Administrators can see active sessions and end any of them.

Roles that actually restrict

Permissions are enforced on the server before a route is dispatched, not hidden in the interface. A beta user requesting an admin URL directly is refused.

Sign-in attempts are limited

Failed attempts are counted per email address and per network address, in the database — so discarding a cookie does not reset the count.

What we have not done

A security page listing only strengths is not a security page. These are the gaps we know about.

No two-factor authentication

Accounts are protected by a password alone. 2FA is planned and not built.

No password reset by email

There is no outbound mail path that is not one of your own connected mailboxes. An administrator sets a new password and sends it to you.

No independent security audit

Nobody outside the team has reviewed this code. We are not going to imply otherwise.

Your browser is the weak point

Because your contacts live there, anyone with access to your unlocked computer has access to your list. Lock your screen.

Found something? Email security@starlinecart.com with what you found and how to reproduce it. We will acknowledge within two working days, and we will not take action against anyone who reports a problem in good faith.