Security
Security at MapDove
Location data deserves care. Here is how we protect your account, your analyses and the aggregated data we serve.
-
Account security
- Passwords hashed with a memory-hard algorithm (Argon2)
- Optional TOTP two-factor authentication for every user; strongly encouraged for admins
- httpOnly, SameSite session cookies, Secure in production
- Per-organization roles: owner, admin, member
-
API keys
- Organization-scoped keys with a visible prefix
- Secrets shown once and stored only as hashes
- Instant revocation and last-used timestamps
- Usage counted per month against the plan
-
Auditability
- Every sign-in, failed sign-in, key, billing and admin event is written to an audit log
- Organization audit trail available to owners and admins
- Audit exports on Enterprise
-
Data protection
- TLS for all traffic
- Aggregated data only — places, hexagons and segments, never individuals
- Re-identification and surveillance prohibited by our acceptable-use policy
- Data processing addendum available
-
Infrastructure
- Isolated production environment with least-privilege access
- Automated backups of the application database
- Error tracking with personal data scrubbed
- Dependencies monitored for vulnerabilities
Responsible disclosure
Found a vulnerability? Email security@mapdove.com with details and steps to reproduce. We acknowledge reports within two business days and will not pursue good-faith research.