How we approachsecurity.

Account security

• Passwords are protected with a modern password-hashing approach rather than stored in readable form.
• Browser authentication uses opaque, revocable server-side sessions and secure cookies rather than placing long-lived account tokens in localStorage.
• Email verification, password-reset protections, rate limiting and session revocation protect sensitive account actions.
• Password resets can invalidate older sessions so lost or compromised sessions do not remain trusted indefinitely.

Licensing and device security

• License, trial and activation decisions are enforced by the Nejma API rather than trusted solely to browser or extension UI state.
• Device Identity v2 evaluates multiple protected device signals for higher-confidence eligibility checks instead of relying on a computer name, IP address or another easily changed label. Stored signals are protected before persistence and are not exposed through the activation website.
• Paid device seats can be revoked or transferred through account controls, subject to license rules and abuse protection.
• Private product downloads and runtime updates use authorization and short-lived delivery controls rather than public permanent file URLs.

Infrastructure boundaries

• Public services use HTTPS and controlled application entry points.
• Database and cache services are intended to remain behind private infrastructure boundaries rather than expose their service ports publicly.
• Production secrets belong in protected server environment configuration, not frontend bundles or source-control history.
• Request IDs and structured logs support incident investigation without intentionally logging passwords, session cookies, verification secrets or private API keys.

Recovery and operations

• Database backups are maintained separately from ordinary application state.
• Health checks verify service availability without exposing sensitive internal details.
• Security controls and restoration procedures are reviewed as production usage grows.

Security reporting

Security concerns can be reported through https://nejma.app/contact. Do not test Nejma systems in a way that could access another user's data, disrupt service availability, defeat licensing for unauthorized use, or bypass authorization.