Legal

Security

Last updated September 2026 · standardunionservices.org

---

Credentials

Passwords and PINs are stored as one-way hashes and cannot be read by staff or recovered from a database copy. Legacy plaintext values are re-hashed automatically the first time they are used.

Sessions

Session identifiers are rotated on sign-in, cookies are httponly and same-site, and sessions expire on both idle time and absolute age.

Requests

Every state-changing request carries a CSRF token verified server side. Destructive actions are never reachable by a GET request.

Data access

All database access uses parameterised queries. Customer records are scoped by session, so one customer cannot read another account by changing a URL.

Reporting a problem

If you believe you have found a security issue, email support@standardunionservices.org with the details. We will acknowledge within one business day and will not pursue researchers who report in good faith.

---

Questions about this document? Email support@standardunionservices.org.