All traffic is encrypted in transit with TLS and application data is stored with encryption at rest. Passwords are bcrypt-hashed, sessions use secure httpOnly cookies, and logins are rate-limited. Payments are processed by Stripe (PCI-DSS Level 1) — card numbers never touch our servers. Your data is yours: export it anytime from Settings or request deletion. Report vulnerabilities to info@herbergllc.com.