How Spacement protects your data
What secures accounts, traffic and backups at Spacement, which data we never store in the first place, and where you can tighten things yourself.
· 읽는 시간 2분
이 가이드는 독일어와 영어로 제공됩니다. 지금은 영어 버전을 보고 있습니다.
This page describes how Spacement handles your data. No marketing language, concrete where it can be, and clear about where the limits are.
Passwords
Passwords are never stored in the clear. They are hashed with bcrypt, a method that is deliberately slow to compute so that guessing at scale stops being worthwhile. We use a cost factor of 12.
A hash like that cannot be turned back into the password. That is also why we cannot tell you your password, only offer you a way to set a new one.
Traffic
Everything between your browser and Spacement goes over HTTPS. A service sits in front of the application, absorbing attacks and terminating the connection before it reaches our server at all.
Signing in
On top of your password you can turn on a second factor: authenticator app, emailed code or passkey. The two-factor guide walks through it.
With passkeys, Spacement checks on the server whether your device actually verified you during sign-in. A passkey without that check is accepted only as the second step after a password, never as a complete sign-in on its own.
Sign-in attempts are rate limited, so working through a list of passwords does not get far.
What we never store
We do not take card numbers or bank details. The payment runs at the payment provider and those details stay there. That is why a data export cannot include them: we do not have them.
Hosts give us no payment details either. Rent for a space is agreed directly between the two parties and does not run through Spacement.
Backups
The database and uploaded images are backed up daily and shipped encrypted to separate storage in the EU. The run is monitored, and a failed one reports itself.
Access inside the team
Visibility in the directory is tiered. Without paid access, operators see only the city and an approximate area on the map, not the exact address and no contact details. That check runs on the server, not just in the interface.
Inside the team the same principle applies as with messages: access only when there is a reason, and logged.
Where the limits are
No system is beyond attack, and this page does not claim otherwise. What we can commit to is care in the places where things actually go wrong: passwords, sign-in, transport, backups.
The most effective contribution from your side stays simple. Use a password you use nowhere else, and turn on a second factor.
자주 묻는 질문
- Does Spacement store my card details?
- No. Payments run through our payment provider, which takes and keeps the card details. They are not on our servers.
- Where are the servers?
- The application and the database run on a server in the European Union. The encrypted backups are held in the EU as well.
- Can somebody on the team read my messages?
- Messages are not end-to-end encrypted, so technically they are readable. Access happens only when there is a reason, such as an abuse report, and it is logged.
- What can I do myself?
- Two things with outsized effect: a password you use nowhere else, and a second factor. Both take a few minutes.