SECURITY · PROGRAMME
How PFR protects the data traders trust us with.
Purchase claims, payout proofs and reviews are the most sensitive things on the site. This page says how they are stored, who can reach them, and how we find out when something is wrong.Purchase claims, payout proofs and reviews are the most sensitive things on the site. This page describes how they are stored, who can reach them, and how we find out when something is wrong.
Encryption
Pages and uploads travel over HTTPS. Receipts and review proofs go to private storage and never get a public link. Cover card numbers before you upload.Pages and uploads travel over HTTPS. Receipts and review proofs go to private storage and are never given a public link. Cover card numbers before you upload.
Access
Only PFR staff with access to the matching console queue can open a proof, and only inside the staff console. Firms never see proof files.
Monitoring
Public endpoints are rate-limited, and each account can upload at most 10 files an hour.
What happens when you report somethingDisclosure timeline
Hour 0
Report received
Email security@propfirmsranking.com with the steps and the impact. The reply carries a reference.Email security@propfirmsranking.com with the steps and the impact. The reply carries a reference.
Within 6 h
Triage
Severity assigned, with the CVSS score we used.Severity assigned with the CVSS score we used.
48 h · critical
Fix deployed
Critical within 48 hours, high within 7 days, others within 14.Critical within 48 h, high within 7 days, others within 14.
Day 30
Public note
A short entry on this page, crediting the reporter unless they prefer anonymity.A short entry on this page, credit to the reporter unless anonymous.
