Security
Effective Date: October 17, 2026
GlobalDeal is run by a small team and does not hold any security certifications. This page lists what we actually do to protect accounts and data, and how to tell us about a problem.
1. What We Do
- HTTPS everywhere — all traffic is encrypted in transit, and browsers are told to use HTTPS only (HSTS).
- Sign-in — handled by Keycloak, which stores passwords only as salted hashes. You can also sign in with Google.
- Admin access — admin functions are limited to named accounts.
- Databases — not reachable from the internet; a firewall blocks outside access.
- Rate limits — on forms and the API, to slow down abuse and automated attacks.
- Secrets — passwords and keys for our systems are kept out of the source code.
- Payments — donations are processed by Stripe. We never see or store card details.
2. What You Can Do
- Use a strong password that you do not use anywhere else.
- Do not share your login details.
- Log out when you use a shared or public device.
- If you think someone has used your account, tell us through /request.
3. Reporting a Vulnerability
If you find a security issue, please report it through the request form at
/request and say that it is a security report. Please include:
- What the issue is and what an attacker could do with it.
- Steps to reproduce it.
- Any supporting material (screenshots, requests, logs).
We reply within 5 business days. Please give us reasonable time to fix the issue before you make it public, and do not access other people's data, disrupt the service or use social engineering while testing. We will not take action against good-faith reports that follow these rules.
4. If Something Goes Wrong
If a personal data breach happens, we will notify the authorities and the people affected as the law requires — for example, within 72 hours to the supervisory authority under the GDPR.
5. How Long We Keep Data