Built to keep each business account separate.

• Passwords are stored as salted hashes, not readable passwords.
• New passwords use a length-based passphrase policy and locally reject known common or compromised patterns, account identifiers, repeated sequences, and current-password reuse.
• Administrator and client sessions are signed and revocable.
• Sensitive pages and actions check the signed-in user’s role on the server.
• Client organization scope comes from the authenticated session; client-supplied organization identifiers are not trusted for access.
• Sensitive administrative changes and important workflow events create audit history.

• Stripe-hosted pages handle checkout and billing management, so SixStack Relay does not store full card numbers.
• Stripe and website-form webhooks use signed or secret endpoints, bounded request bodies, replay controls, and staged secret rotation.
• Provider errors shown in the product are sanitized to avoid exposing secrets or raw private responses.

Production responses use HTTPS transport enforcement, content security policy, anti-framing, MIME-sniffing protection, referrer limits, and restrictive browser permissions. Login, reset, webhook, export, notification, billing, and organization-isolation rules have focused automated coverage.

These controls reduce risk; they are not a certification, guarantee, or substitute for customer-side access reviews and secure devices.

Email contact@sixstackrelay.com with “Security issue” in the subject. Describe the affected page, time, account, and observed behavior. Do not send passwords, session cookies, API keys, card details, or live webhook secrets.