How we protect 50heads

These are the controls we run. No system is free of risk, so we also monitor for problems and welcome reports.

The trust centre lists the controls we can show in public, how often we check them, and which role owns each one.

  • No passwords. Sign-in is by Apple, Google or a one-time code, so there is no 50heads password to steal or reuse.
  • Sessions use secure, HTTP-only cookies on the web. In the app, tokens are bound to the device, which is meant to stop a copied token working on another phone.
  • Sensitive actions (changing a payout method, tax details, creating API keys, closing an account) ask you to confirm it is you again.
  • API keys are stored only as hashes, shown once, scoped and capped. Requests that arrive with a browser origin header are refused, so keys are meant for servers and scripts; browsers connect with OAuth.
  • Money moves through regulated providers (Stripe and Wise). We do not store full card or bank numbers.
  • Data is encrypted in transit and at rest. Staff access is limited by role, protected by multi-factor authentication and recorded in an audit log.
  • Uploads are checked for type and size, have image metadata (such as location) removed, and are screened for prohibited content before heads see them.

How we use AI with your data

We don't use your questions, the answers you buy or the reasons heads write to train AI models, and we don't sell them.

We use AI only to summarise and translate written answers, suggest clearer wording for questions, and screen questions and images before heads see them. That runs on Cloudflare Workers AI, our hosting provider, on our instructions. The model never receives who a head is. More in AI and your data.

Reporting a vulnerability

Read the vulnerability disclosure page. It says how to report, what is in scope, what we ask of you, what to expect from us and how our safe-harbour wording works. Reports go through the contact form, and our security.txt points to the same place. We do not pay bounties yet.

Thanks

We'll list people who have helped keep 50heads safe here.