Security Shield

Security & Privacy

We utilize state-of-the-art protections to secure your data and maintain communication integrity.

1. Data Protection & Encryption

All data transmitted between your device and Way2Better servers is encrypted in transit using Transport Layer Security (TLS 1.3/SSL). Data stored in our database is encrypted at rest using Advanced Encryption Standard (AES-256) keys. We regularly run security reviews to identify and mitigate platform vulnerabilities.

2. Email Authentications & SPF, DKIM, DMARC

To protect our users from phishing attempts and spoofing, all email communications dispatched by Way2Better undergo robust DNS-level authentications:

  • Sender Policy Framework (SPF): We maintain strict DNS records specifying authorized server IPs eligible to send mail under the `way2better.com` domain.
  • DomainKeys Identified Mail (DKIM): All outgoing emails are cryptographically signed with private keys. Receiving mail servers verify this signature using our public keys published in DNS.
  • Domain-based Message Authentication, Reporting and Conformance (DMARC): We enforce a DMARC policy that instructs receiving servers how to handle emails failing SPF or DKIM checks, preventing unauthorized spoofing.

3. Account Protection & Authentication

We protect user accounts against unauthorized access through several layers:

  • Secure Hashing: Passwords are cryptographically salted and hashed using the bcrypt algorithm before storage.
  • Session Safeguards: Authenticated sessions utilize securely signed JSON Web Tokens (JWT) with automatic expiration times.
  • Interactive CAPTCHA: We enforce interactive CAPTCHA validation during signup, password reset requests, and excessive failed login attempts to block bots.

4. Rate Limits & Anti-Abuse

To prevent Denial of Service (DoS) attacks and SMTP email resource abuse, we implement strict API rate limits:

  • OTP Dispatch: Limited to a maximum of 5 requests per hour per email/IP.
  • Password Reset: Limited to a maximum of 3 requests per hour.
  • Verification Emails: Limited to a maximum of 5 requests per day.
  • College Invitations: Capped at 100/day and 500/month per institution.

5. Vulnerability Disclosure

If you discover a security issue on our platform, we encourage you to report it to our security response team at security@way2better.com. We will investigate all reports promptly.