Security
LicenseFort holds a real amount of trust — your source code, and the ability to stop your software running for your customers. Here's what actually protects that, described plainly rather than with certifications we don't hold.
Passwords never stored in plain text
Account passwords are hashed with Argon2id, the current OWASP-recommended algorithm for password storage — not a fast general-purpose hash, and never reversible.
License keys hashed and encrypted, not plaintext
The license key your customers use is looked up by a one-way SHA-256 hash, and stored at rest as AES-256-GCM ciphertext — not as plain text. A database-only compromise doesn't hand over usable keys.
Rate limiting on authentication and abuse-prone endpoints
Login, signup, and the contact form are all rate-limited by IP (and, for login, by account) to slow down credential stuffing and abuse.
Per-tenant data isolation
Every dashboard and API query is scoped to the authenticated tenant — verified by an automated regression suite that actively tries to access one account's data from another and asserts it's refused, run on every code change.
A real Content-Security-Policy
Restricts script, frame, and connection sources sitewide — reduces the blast radius of a cross-site-scripting bug rather than relying on it never happening.
Encryption in transit and at rest
TLS everywhere; stored data, including uploaded source material, is encrypted at rest.
Signed, verified webhooks
Payment webhooks (Paddle, NowPayments) are cryptographically verified before anything is acted on — an unsigned or forged request can't unlock a subscription.
No certifications claimed
LicenseFort doesn't currently hold SOC 2, ISO 27001, or any other third-party security certification. If that changes, this page will say so, with the actual certificate — not before.
Found a security issue? Please report it responsibly to support@licensefort.com — see /.well-known/security.txt.