October 31, 2026
Security
Plain words on what keeps Ekimeet and your data safe, and how to tell us about a weakness.
What is in place
Everything travels encrypted (HTTPS, with certificates renewed by themselves).
The servers accept only SSH keys, apply security updates on their own, and expose nothing but the web ports; the database and cache are never reachable from the internet.
The app connects to its database with a role that can only touch rows, and the audit log can only be written, never changed.
Secrets live only in the environment; the app refuses to start without them.
Encrypted backups go every night to a second place outside the hosting provider, and a restore is rehearsed every month.
Admins sign in with two factors, and every admin action is logged with a reason.
Found a weakness?
Write to the address below. Tell us what you found and how to see it; a proof of concept is welcome, access to other people's data is not. Please do not test on real accounts or disrupt the service.
security@ekimeet.com
Machine-readable: /.well-known/security.txt
What happens next
We reply within 3 working days, keep you informed while we fix it, and credit you if you wish. We do not take legal action against good-faith research that follows this page.