Security

1.How we protect your data

Go Lancer holds your clients, your invoices and your income. This page says plainly what protects that, in terms you can check. We describe what is in place today, not what we plan to build.

2.Encryption

Every connection to Go Lancer runs over HTTPS, so nothing travels in the clear between your browser and our servers. The same applies to the emails we send on your behalf.

Your password is never stored. What we keep is a bcrypt hash with a work factor of 12, which cannot be turned back into your password, not by us and not by anyone who ever got hold of the database. If you ask to reset it, we send you a one-time link rather than your old password, because we do not have it.

When you connect another service, Go Lancer never sees or stores your password for it. The connection runs through that provider's own OAuth, and the access token we get back is encrypted with AES-256-GCM before it is stored. That covers Google Calendar and Gmail, HubSpot, Notion, Toggl, Clockify and Harvest.

3.Your data is yours alone

Go Lancer is one application serving many freelancers, so the line between accounts is the thing that matters most. Every request is checked against the account that made it, and every database query is limited to that account's own data. There is no screen, export or API route that can return another freelancer's clients or invoices.

This is covered by automated tests that run before anything ships: if a change ever let one account read another's data, the build fails.

4.Sign-in and accounts

There are three ways in: email and password, your Google account, or a one-time link sent to your inbox. Sign-in, sign-up and password-reset routes are rate-limited, so an email address cannot be used to guess a password by brute force. The rest of the API is rate-limited too.

Once you are in, your session lives in an HttpOnly cookie. No script running on the page can read it, which is the point: if a bug ever let hostile code onto a Go Lancer page, it still could not walk off with your session. The cookie is marked Secure, so it never travels over an unencrypted connection, and SameSite, so another site cannot make your browser act as you.

Password reset links expire after an hour, email confirmation links after seven days, and each one can be used once. Changing your password signs out every other session, so whoever else had the old one is out immediately. Accounts that have not confirmed their email address cannot send anything to your clients.

5.Where your data lives

Everything sits in the EU. These are the only companies that process your data, and each one only for its own part of the service:

Files you upload are not public. There is no guessable address for an invoice or an attachment: every file is served through the API and only after it has checked that the account asking for it is the account that owns it.

We never see or store your card number. When you pay for Go Lancer, your card details go straight to Stripe and never touch our servers.

6.In the application

Security headers are set on every response, through the standard helmet middleware. Everything a user sends is validated against a schema at the server before it reaches the database, so a malformed or hostile request is rejected rather than interpreted. Payment events from Stripe are only accepted when their signature checks out, so nobody can tell us an invoice was paid when it was not.

Nothing reaches the live site by hand. Every change runs through an automated pipeline first: the test suite, the database migrations, and an audit that fails the build on a known high-severity vulnerability in anything we depend on. A weekly robot opens a pull request whenever one of our dependencies publishes a security fix, so updates do not wait for someone to notice them.

7.Deleting your data

You can delete your account yourself, from My Account under Security. It cancels your subscription and removes your data straight away. No email to support, no waiting period, no retention of a copy we forgot to mention.

You can also export everything you have put in, at any time, without asking us.

8.If something goes wrong

No online service can promise perfect security, and we are not going to pretend otherwise. What we can promise is what happens if a breach ever affects your data: we tell you and the supervisory authority without undue delay, and we tell you what we actually know rather than what sounds reassuring.

If you have found something that looks wrong, write to [email protected]. It reaches a person, usually within a day, and a real problem gets fixed before anything else that week.

9.What we have not done yet

Go Lancer is a small, founder-run product, and some things larger companies have are not in place:

• No SOC 2 or ISO 27001 certification. Our infrastructure providers hold their own, but we do not.
• No two-factor authentication on Go Lancer accounts yet. It is on the roadmap. Signing in with Google uses whatever two-factor you have on your Google account.
• No external penetration test so far.
• No team workspaces: an account is one person. If you need several people in one workspace, Go Lancer is not that yet.

We would rather say this here than let you find out later.

10.Contact

Security questions, or anything that looks like a weakness: [email protected]. For how we handle personal data more broadly, see the Privacy Policy.