Security

Last updated 2026-10-01

In plain English

• Everything you send us travels over HTTPS.
• You sign in with a licence key, not a password. Keep it private.
• Stripe takes your payment. We never see your card number.
• Found a security bug? Tell us at [email protected].

This summary is here to make the page easier to read. It is not the full text. If the two ever seem to differ, the full text below is what counts.

Every sentence on this page is one a customer can check. That is the point of it, and it is why nothing appears here that is not true today.

In transit

All traffic is served over HTTPS, with HTTP redirected. Certificates are issued and renewed automatically.

At rest

Not yet configured — and this page says so rather than implying otherwise.

Access

Accounts are held by licence key. There are no passwords to reuse or leak, and no password reset flow to phish. The trade-off is that anyone holding the key has access, so treat it like one.

Backups

Our database host takes scheduled backups of the database every day, every week and every month.

Payment data

We never receive your card number. Stripe processes payments and is PCI DSS Level 1 certified.

Reporting something

If you find a vulnerability, tell us at [email protected]. We will acknowledge it, and we will not pursue anyone who reports in good faith and does not access other people's data.

Owner Math is operated by TBG Strategic Consulting LLC. Questions about this page: [email protected].