Security & Privacy

v1.0

Security & Privacy

PowerSoftware hardens its platform across accounts, data, APIs, and infrastructure, and continuously monitors anomalies through logs and alerts. Below are the security measures currently implemented.

1. Account & Login Security

  • Password policy: 6-20 characters, must contain both digits and letters;
  • Brute-force protection: repeated failed logins from the same IP trigger rate limiting; retry after a cooldown;
  • Anti-SMS-bomb verification: sending email verification codes requires human verification (Cloudflare Turnstile), with tiered frequency limits per account (5 minutes, 15 minutes, 30 minutes);
  • Third-party login: Google, QQ and Alipay logins require email binding for full features; OAuth uses one-time state to prevent CSRF, expiring in 10 minutes;
  • Binding security: third-party identifiers are encrypted, and emails are masked in display.

2. Data Security & Privacy

  • Sensitive fields are encrypted at rest: real names, feedback contact info, and third-party identifiers (openid/unionid) are encrypted, with one-way hashes for lookup (no plaintext);
  • Email masking on display, e.g. 1***@qq.com;
  • Storage isolation: public and private resources are stored in separate buckets; private buckets are not publicly accessible;
  • Minimal collection: only business-required personal data is collected.

3. API & Business Security

  • License APIs: HMAC-SHA256 signing + timestamp anti-replay (5-minute window) + order idempotency prevent forged requests and duplicate issuance;
  • License activation rate limiting: repeated failed activations from the same IP / license code trigger throttling;
  • Cache safety: failed responses are never cached, preventing error results from being spread by edge caches;
  • Input validation: all API inputs are validated against schemas; invalid input is rejected.

4. Infrastructure & Network Security

  • Cloudflare global network: built-in DDoS protection and edge caching;
  • Security headers: HSTS, CSP, X-Frame-Options (clickjacking protection), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, active in production;
  • Cache deception protection: Cache Rules with Cache Deception Armor enabled;
  • Secret management: payment, email, and translation keys are kept server-side only.

5. Monitoring & Auditing

  • Structured logs: unified JSON request logs (request ID, IP, duration, status) with full traceability by request ID;
  • Operation audit: key admin operations are recorded;
  • Real-time alerts: email/translation service failures push alerts to DingTalk, with quota errors alerted at most once per 60 minutes.

6. Continuous Improvement

  • We continuously review dependencies and security settings and fix issues promptly;
  • Security issues are welcome via product feedback or the contact email.