Security

• Researchers sign in with a single-use link sent to their email address. There is no password to steal or reuse.
• A sign-in token is stored hashed, works once, and expires after 15 minutes.
• The emailed link opens a page that asks you to continue; only that press signs you in, so a mail gateway that opens links before you do cannot use yours up. The same email carries a six-digit code for signing in on another device; it is stored hashed, works once, and is cancelled after five wrong tries.
• Sessions are held on the server and can be ended from Settings; ending another session is recorded in the audit log.
• Panelists reach their pages through signed links that carry no account. A link that cannot verify is refused before any page is served.

• Names and email addresses are stored in their own table, encrypted at rest with AES-256-GCM, apart from responses.
• Responses, submissions, coding, exports, feedback and the audit log never hold a name, an email address or a token.
• Finalized research data is never changed silently. A correction, an amendment or a removal creates a new version through an authorized, audited path, and history tables refuse updates and deletes.
• Results are reported in groups no smaller than the study's stated minimum, and the panel's anonymity floor is enforced when a study is set up.
• Each study sets a retention period for identifiable data before launch. Deletion happens only on a recorded request approved by a second investigator, never on a timer.

• Every organization and every study keeps an append-only log. Entries are hash-chained, written in the same transaction as the change they record, and the chain is verified on read and on export.
• Database triggers block updates, deletes and truncation of the log.

• All traffic uses TLS. In production, HTTP Strict Transport Security is set.
• Researcher pages carry a content security policy that forbids framing, restricts form targets and base URLs to the platform, and disallows plugins, plus nosniff and a referrer policy.
• Every server action and route handler validates its input and re-checks authorization on the server. User text is escaped on output. Uploaded images are checked by their bytes, and PNG and JPG are the only accepted kinds.
• Public forms are rate-limited and fail closed.

• Open and click tracking are switched off for every message the platform sends.
• The full text of a message to a panelist is sealed with the identity key and purged after 90 days by default. The kept archive holds the template with the name and link replaced by placeholders.
• Outside production, the platform can send only to a local test inbox, so a preview or development build cannot reach a real panelist.

• Logs pass through a scrubber that removes tokens, addresses and secrets.
• Error reports leave out the user, cookies, headers, request bodies and query strings. No error reporting or any other script is loaded on the pages panelists use, and there is no product analytics.

If you believe you have found a vulnerability or suspect unauthorized access, write to info@delphistudio.org or use our contact form. Please leave panelist identities and health information out of your message.