Skip to content
Nemorgi

Security

How we protect the platform and how to report a vulnerability.

Last updated:

Draft pending legal review

The site is free and has no commercial activity. Before charging or showing advertising, the owner's details will be added and a qualified professional will review this document. This English version is a translation provided for convenience; if it differs from the Spanish version, the Spanish version prevails.

Principles

  • Encrypted connections via HTTPS.
  • No accounts or database with personal data: there are no passwords or profiles to protect.
  • Keys and secrets kept out of the code and the browser.
  • The query server only accepts a closed list of public sources and limits requests per origin.

We don't claim any system is completely secure or publish certifications we don't have.

Report a vulnerability

Write to us at contact@nemorgi.com with a description of the problem. Don't access other people's data or degrade the service while investigating. We'll reply and keep you informed about the fix.

Technical measures

  • Content Security Policy (CSP) that only allows our own resources, Cloudflare's statistics script and Google Analytics (the latter only if you accept it), with no third-party iframes or embedded objects.
  • Pages are static files: they do not run code on the server.
  • Automatic check for secrets in the code before each deployment.

Incidents

If a breach affecting personal data occurs, we'll notify the Spanish Data Protection Agency within 72 hours of becoming aware of it, unless it's unlikely to pose a risk, and the people affected without undue delay when the risk is high (arts. 33 and 34 GDPR).