The website

The whole site is served over HTTPS with HSTS enabled. We ship strict security headers on every response:

• • Content-Security-Policy - restricts what the page can load
• • X-Frame-Options: DENY plus frame-ancestors 'none' - the site can't be embedded in other pages
• • X-Content-Type-Options: nosniff - prevents MIME-sniffing attacks
• • Referrer-Policy - limits what information is sent to other sites
• • Permissions-Policy - blocks camera, microphone, and geolocation access by default
• • Strict-Transport-Security - forces HTTPS for future visits

Payments

Subscriptions are processed by Stripe, a PCI-DSS Level 1 service provider. We never store or handle card numbers, and you provide your payment details directly to Stripe over an encrypted connection.

Accounts

Supporter accounts are protected with:

• • Passwords stored as salted hashes using a modern, memory-hard algorithm
• • One active session per IP, with older sessions revoked automatically
• • A maximum of two active devices per account to limit credential sharing

The desktop app

Borderlessify runs locally on your Windows machine. Config files, themes, and profiles are stored on your device - nothing is uploaded automatically. The app only talks to our server when you sign in to use Supporter features.

What we're working on

We're hardening email delivery with SPF, DMARC, and MTA-STS so mail sent from the borderlessify.com domain is authenticated and can't be spoofed. The records below will be published at the DNS level:

MX  @ 10 mx.sendgrid.net.
TXT @ "v=spf1 include:sendgrid.net ~all"
DMARC at _dmarc with "v=DMARC1; p=none;..."
MTA-STS at mta-sts with "v=STSv1; id=1"

Reporting a problem

Found a security issue? Email borderlessify@gmail.com. We take reports seriously and will respond promptly.