Security

Economic development offices, governments and newsrooms trust PLACES with their work. Here is how we protect it, plainly stated, including what we have not finished yet.

Hosting and transport

• Hosted on Amazon Web Services in the United States (us-east-1).
• All traffic is encrypted with TLS 1.2 or 1.3; plain HTTP redirects to HTTPS.
• Security headers on pages and API responses, and request rate limits on sign-in, sign-up and other sensitive endpoints.

Accounts and access

• Passwords are stored only as bcrypt hashes (cost 12); we cannot read them. Changing your password signs out your other sessions.
• Session cookies are HttpOnly, Secure and SameSite; every change request also carries a separate anti-forgery token.
• Access is enforced on the server for each tool (public, free account, subscriber, admin), not just hidden in the page.
• Administrative tools run on a separate internal site, behind their own administrator check, and are never served on the public site.
• Agent (MCP) tokens are stored as hashes, shown once, limited per account, and can be unplugged at any time.
• Settings shows every place you are signed in, with “sign out everywhere else”.

Data

• Nightly database backups go to a separate storage bucket; source data copies are kept in write-once storage (S3 Object Lock) so the record behind every figure cannot be quietly changed.
• Credentials are kept out of the code repository, in AWS Secrets Manager or a root-only server file, and the server’s cloud permissions are limited to what it needs.
• We do not call AI model providers from our servers, so your work is not sent to one.
• Account changes, sign-ups, token creation and admin approvals are written to an audit log; each token records when it was last used.

Still on our list

• Encrypting the application server’s disk at rest (storage buckets are already encrypted).
• Two-factor sign-in for workspace owners and admins.
• An independent security review before statewide contracts.

Report a problem

If you find a vulnerability, email admin@placesineverheardof.com with “Security” in the subject. Please give us reasonable time to fix it before sharing it, and do not access other people’s data. We will acknowledge within 2 business days and tell you when it is fixed. If an incident affects your data, we will notify you without undue delay and explain what happened and what we did.