Security at Handsly

Our approach: security by design

We build Handsly around security and privacy by design. That means we collect as little data as possible, protect it by default, and never expose more than what the app genuinely needs to work.

The relationship graph is computed server-side and never exposes a member's address book. An intermediary's identity stays hidden until they consent: no introduction happens without agreement.

Protecting your credentials

Your password never leaves our systems in clear, and it is never kept as-is.

• Passwords are never stored in clear: we only keep a bcrypt hash (cost factor 12).
• Authentication relies on short-lived JWT access tokens (15 minutes), paired with rotating refresh tokens (30 days).
• Refresh tokens are hashed server-side and revocable: a session can be cut at any time.
• Reuse detection invalidates a session if a stolen token is replayed.
• On your device, auth tokens are kept in the system secure vault (iOS Keychain, Android Keystore), never in plain storage.

Protecting your contacts

When you import your contacts to detect shared relationships, we never keep your emails or phone numbers in clear.

• Imported emails and phone numbers are turned into irreversible SHA-256 hashes, never stored in clear.
• These hashes are used only to detect private matches between members, and cannot be reversed back to the original contact.
• Your address book is never shown to other members: introductions happen without revealing it.

Encryption and infrastructure

Your data is protected in transit and at rest, on hardened infrastructure hosted in Europe.

• All traffic is encrypted in transit over HTTPS / TLS.
• The server is hardened: security headers, rate limiting on sensitive endpoints, strict input validation and least-privilege access.
• The MongoDB database is hosted in Europe, with access restricted by a network allowlist.

Account safety

You stay in control of your presence on Handsly and of who you interact with.

• You can report or block another member at any time.
• Our team triages reports and steps in when there is abuse.
• You can permanently delete your account and your data directly from the app.

Responsible disclosure

We welcome the work of security researchers. If you believe you have found a vulnerability, email us at app@handsly.io.

Our team will respond, and we will not pursue good-faith research. Please give us a reasonable window to fix the issue before any public disclosure.

Handsly is operated by Fibroweb (https://fibroweb.fr).