A transparent look at the real security controls behind Veer — password hashing, encrypted sessions, encrypted transport, and server-side enforcement of everything that matters for a fair, trustworthy assessment.
Passwords are hashed with bcrypt at 12 rounds, with a per-user salt built into every hash. Plain-text passwords are never stored.
Login sessions use iron-session — encrypted and signed, httpOnly, secure in production, sameSite=lax, expiring after 7 days.
All traffic is served over HTTPS with TLS 1.2+, and HSTS is enforced so connections are always encrypted.
State-changing forms are protected with synchronized (synchroniser) CSRF tokens.
Sensitive actions are rate-limited — e.g. login capped at 10 attempts/5 min per IP, registration at 5/15 min per IP.
Stripe handles all card data directly. Veer never stores your card number on its own servers.
Infrastructure and data live in the EU West (Ireland) region, with no transfer outside the UK/EEA without a legal safeguard.
Assessment timers, scoring, and invitation tokens are always enforced server-side — never trusted from the browser.
Passwords are hashed with bcrypt at 12 rounds before storage, with a per-user salt built into the hash — never stored or logged in plain text.
Once logged in, your session lives in an encrypted, signed cookie (veer_session)
managed by iron-session: httpOnly so it can't be read by page scripts, marked secure in production, set to
sameSite=lax, and expiring automatically after 7 days.
A sliding-window rate limiter protects endpoints that are common abuse targets. Representative limits:
Veer does not hold ISO 27001, SOC 2, or similar third-party certifications — we describe our real controls transparently instead of claiming ones we don't have.
Create an account with confidence — your credentials and data are protected at every layer.
Passwords are never stored in plain text. They're hashed with bcrypt at 12 rounds, with a per-user salt built into the hash itself, before being written to the database.
Sessions use iron-session, stored in an encrypted and signed cookie (veer_session) that is httpOnly, secure in production, and set to sameSite=lax, expiring after 7 days. Assessment timers, scoring, and invitation tokens are always enforced server-side and never trusted from the browser.
No. Stripe handles all card data directly. Veer never stores your card number, expiry, or CVC on its own servers.
Yes. All traffic is served over HTTPS with TLS 1.2+, and HSTS is enforced so browsers only ever connect over an encrypted connection.
Sensitive endpoints are rate-limited. For example, login is capped at 10 attempts per 5 minutes per IP, and registration at 5 attempts per 15 minutes per IP, alongside limits on quiz starts, CV uploads, and other actions.
Veer's infrastructure and data reside in the EU West (Ireland) region, giving UK/EU data residency, with no transfer outside the UK/EEA without a legal safeguard such as Standard Contractual Clauses.
Veer does not currently hold ISO 27001, SOC 2, or similar third-party security certifications. Our security practices — password hashing, encrypted sessions, TLS/HSTS, CSRF protection, and rate limiting — are described transparently on this page.