Security
How we protect your account and your study data.
USMLEPrep is operated by Haven Technologies Inc. We take the security of your account seriously and design the platform to keep your credentials, payment information, and study history safe. Below is a plain-language summary of the controls we run in production.
Encrypted in transit
Every request is served over TLS 1.2+ with auto-renewing certificates. HTTP is redirected to HTTPS and HSTS is pinned so browsers refuse to connect any other way.
Passwords never stored in the clear
Account passwords are hashed with bcrypt (cost 12). They are never logged, never returned by the API, and cannot be recovered — only reset.
Payments handled by Stripe
Card details never touch our servers or database. Stripe processes every charge; we only keep opaque customer and subscription references.
Role-based admin access
Every administrative route is RBAC-checked server-side and destructive actions are written to an immutable audit log. Sessions re-verify your role against the database on a short interval.
Hardened infrastructure
The server accepts only web and SSH traffic, authenticates SSH by key, and keeps the database off the public internet. Rate limiting guards authentication and AI endpoints against abuse.
Sanitized content
All rich text and outbound email is sanitized or HTML-escaped on write against a strict allowlist, so authored content can't smuggle in scripts.
Reporting a vulnerability
If you believe you’ve found a security issue, please email security@usmleprep.org rather than opening a public issue. Include a short description of the impact and clear steps to reproduce. We acknowledge reports within two business days, aim to triage within five, keep you updated on remediation, and are glad to credit you once a fix ships.
In scope: the production deployment, all API routes, the Stripe webhook, and every authentication flow. Out of scope: third-party vendors (report to them directly), social engineering of our staff, and volumetric denial-of-service.
This page is a summary. Questions about our security or data-handling practices? Email security@usmleprep.org.