Security

PepMe holds long-running personal data — protocols, journal entries, progress photos, bloodwork records. Here's how we protect it.

Encryption

In transit. All traffic between your device and our servers runs over HTTPS using current TLS standards.

At rest. Database records and uploaded files are encrypted on disk using server-side encryption with managed keys.

We do not currently offer end-to-end encryption — your data is encrypted while we hold it, but it is not encrypted in a way that prevents PepMe from accessing it. We mention this explicitly so you can make an informed decision about what to share.

Authentication

Passwords are hashed using bcrypt with a per-user salt before storage. Active sessions use signed API tokens scoped to your account, which you can revoke from settings.

Identity verification

PepMe does not currently use identity verification. If this changes in the future, we will update this policy accordingly.

Photos

Progress photos are stored in private object storage on Amazon S3. Photos are served only through short-lived signed URLs that are accessible only to you. Other users cannot access your photos.

Access controls

Access to production systems is restricted to a small number of engineers. Production access is logged. We follow the principle of least privilege — engineers get the access they need to do their work and no more.

Responsible disclosure

If you find a security issue, please tell us before sharing it publicly. Email [email protected] with a description of the issue and steps to reproduce. We'll acknowledge within 72 hours and work with you on a fix.

We don't currently run a paid bug bounty program, but we recognize researchers who report valid issues responsibly.

Incidents

If we ever experience a security incident affecting your data, we'll notify you as soon as we have a clear picture of what happened and what's needed from you. We won't bury bad news.