Security
Security and data protection
PowerGridTools is built so that the engine, the accounts and the files stay on our servers, and the browser receives only what it needs to show the application.
Where your work runs
Three parts work together. Only the first one runs on your computer.
Your browser
Runs the user interface after you sign in. It contains no analysis engine.
The PowerGridTools platform
Holds your account and your drive, checks every request and forwards analyses to the engine.
The analysis engine
An internal service that is not reachable from the internet. It accepts only requests signed by the platform.
Safeguards
Passwords
Stored only as bcrypt hashes. Repeated failed sign-ins lock the account for a while.
Sessions
Session cookies are HttpOnly and SameSite; every change made from the browser carries a CSRF token.
Drive
One storage area per account, keyed by an internal id, with a quota and a maximum file size. Paths cannot leave it.
Browser protections
A strict content security policy without inline scripts or third-party code, no framing, and no content sniffing.
Rate limits
Sign-in, contact forms and analyses are rate-limited per user or network.
Audit trail
Security-relevant events such as sign-ins, sign-outs and administrative changes are recorded.
Your data
Your projects are yours. They are stored in your drive and used only to provide the service to you. You can download them at any time and ask us to delete your account and its data.