Security

Estaro handles a corporation's money and its members' personal details. Here is what we do about that, in plain terms.

Encrypted in transit

Every request to Estaro is served over HTTPS. Plain HTTP is redirected rather than answered, and browsers are instructed to come back over HTTPS from then on, so a signed-in session cannot be downgraded to an unencrypted one.

Encrypted at rest

Personal details — names, email addresses, telephone numbers, mailing addresses and TRNs — are encrypted field by field in the database, so a copy of the database is not a readable contact list. The database and its backups sit on encrypted storage as well, which covers everything else: budgets, contributions and payment history.

Card details we never hold

Card numbers are entered on the payment provider's own hosted page, not on a form Estaro serves. We keep the card brand, the last four digits and the result of the transaction. The full number and the security code never reach us, which keeps the corporation's payment page out of the reach of anything that goes wrong here.

Accounts and access

• Passwords are stored as bcrypt hashes. We cannot read them, we will never email one to you, and repeated failed sign-ins from the same place are rate limited.
• A session is a signed cookie that scripts in the browser cannot read, tied to a session record we can end.
• Access is granted per corporation. Permissions decide what each member can do there — a treasurer can approve a budget and verify a payment, a proprietor can pay their own contributions and see nothing else.
• Estaro's staff do not hold membership of a corporation. They see registration documents to verify a corporation, and each verification decision is recorded against the person who made it.

Who gets in at all

Every corporation is verified by a person at Estaro before it can collect anything: certificate of registration, proof of address and TRN. Registration and invitation pages are protected against automated signups. Invitations are single-use links that expire, so an old email cannot be used to join a corporation later.

How we build

Estaro is a Rails application, kept current with its security releases. Every change is checked for known vulnerable dependencies and for common web weaknesses before it ships, and the tests that guard who-can-see-what run on every change too.

Telling us about a problem

If you find a weakness, write to hello@estaroapp.com and tell us what you found. We would far rather hear it from you. Please give us a reasonable chance to fix it before making it public.

Last updated July 2026.