Security controls you can verify
A factual overview of the safeguards implemented in the RingSlot application. No online service can promise perfect security.
Passwords
Passwords are hashed with bcrypt using a work factor of 12. Plaintext passwords are not stored.
Sign-in protection
Login attempts are rate-limited. New-device verification is available by email when the required database tables and email service are configured.
API access
Protected routes require a signed bearer token or account API key. Users can regenerate API keys and revoke trusted devices.
Network traffic
Production website and API traffic is delivered over HTTPS. TLS configuration is managed by the hosting providers.
Payment callbacks
Payment notifications require an HMAC signature and are matched to a pending payment, user, and amount before wallet credit.
Order integrity
Wallet deductions, cancellations, and expiry refunds use database transactions and row locks to prevent duplicate refunds or overspending.
Sensitive messages
RingSlot stores the parsed OTP needed to deliver an order, then removes OTP values from completed order records after 24 hours.
Abuse controls
Global, authentication, purchase, password-reset, and contact limits are applied. Administrators can disable users, providers, and abusive IP addresses.
Your part
Use a unique password, protect your API key, verify wallet addresses and networks, never share an OTP, and report suspicious access promptly. Email security reports to support@ringslot.shop. Do not include live credentials or OTP codes.