Encrypted session · TLS

FieldKit

Accounts are issued by an administrator. There is no public sign-up.

Traffic is HTTPS only. Passwords are PBKDF2-hashed. Sessions are HttpOnly Secure cookies. D1 is encrypted at rest.