Security

Your account

• Passwords are stored only as bcrypt hashes; nobody at Gleanloop can read yours.
• Two-factor sign-in with an authenticator app is open to every account, with one-time recovery codes, and is required for administrators.
• Signing out ends your session on the server, and changing your password or two-factor settings signs out every other browser.
• Sign-in, sign-up and password reset are rate-limited per address, and a password reset gives the same answer whether or not an account exists.
• Security changes to your account are sent to you as a notification, and by email once your address is confirmed.

The site

• Every page is served over HTTPS only, and browsers are told never to use plain HTTP for it (HSTS).
• A strict content security policy lets only Gleanloop's own scripts run, each page with its own one-time key, so an injected script can't read your session.
• Uploaded photos are decoded and re-encoded, which removes their location and camera data; photos are never taken for listings of human material.
• Uploaded papers are read in a separate, limited process and never stored.
• The administration screens need an administrator's password and two-factor code, and signed agreements, completed transactions and delivered benefits can't be edited there.

Your records

• The history of every transaction is append-only: steps are added, never changed or removed.
• The database is backed up every night into an encrypted file, and its changes are archived, encrypted, at least every five minutes, so it can be restored to any moment in the last seven days with at most five minutes lost.
• Every change to Gleanloop's code is tested by making a backup, restoring it into a separate copy and checking it row by row, and by restoring the database to a chosen moment.
• You can download everything Gleanloop holds about you, and erase your account, from Settings → Your data.
• Public provenance pages show only what both parties agreed to publish, and never terms, consent scope, benefits or contact details.

Services that handle your data

• ResendSends our emails: your address and the email itself.
• AnthropicWhen you upload a document for a listing's details to be read from it, and when your AI checks run on Claude: the document, or the listing and the purpose being checked.
• Stripe, Flutterwave or PaystackOnly when you buy a plan, through the one you choose.

Other AI checks run on Gleanloop's own server. Lookups in public databases (Europe PMC, OpenAlex, the INSDC, the ABS Clearing-House) send identifiers such as DOIs and accession numbers, never your personal details.

Report a problem

If you think you've found a security problem, email info@gleanloop.com with what you found and how to see it. Please don't test against other people's accounts or data. Our details are also at /.well-known/security.txt. Other ways to reach us.