Security.

This page lists the protections the products have today. Where the products differ, it says which one does what. For how your data is collected, shared and kept, the Privacy Policy is the governing document.

01Passwords

Passwords are never stored in plain text. All three products hash them with bcrypt. Before hashing, the password is normalised and pre-hashed with SHA-256, so a long password is not silently cut short by bcrypt's 72-byte limit. ResearchAnything requires at least eight characters.

• Sign-in gives the same answer for an unknown email and a wrong password, so it can't be used to find out who has an account. ResearchAnything's password reset does the same.
• Sign-in attempts are rate-limited per IP address and per account. Sign-up and code requests are rate-limited too.

02Email codes

ResearchAnything checks that you can read mail at an address before it creates an account. It emails a six-digit code, and nothing is written until you enter it. Password resets and new Essarion IDs use the same kind of code, each for its own purpose, so a code sent for one can't be used for another.

• Codes are drawn from a cryptographically secure random source.
• Only a keyed hash of each code is stored, bound to the address and the purpose.
• A code expires after ten minutes and stops working after a few wrong guesses. Requesting a new code cancels the old one, and a used code is deleted.
• How often codes can be sent is limited per address and per IP address, so the form can't be used to flood someone's inbox.
• Codes are sent from hello@essarion.com over an encrypted connection to the mail server.

03Sessions

When you sign in, the product sets a session cookie holding a token signed with HS256.

• The cookie is HttpOnly, so scripts on the page can't read it, and Secure in production, so it is only sent over HTTPS.
• A session lasts seven days. Signing out deletes the cookie.
• Each product sets its own cookie on its own domain. Signing in to one product does not sign you in to another.
• ResearchAnything refuses any request that would change data using your session cookie if the browser reports that it came from another site. This blocks cross-site request forgery.

04API keys

Developer API keys belong to a ResearchAnything account.

• A key is ra- followed by a random 24-byte secret. It is shown in full once, when you create it.
• Only a SHA-256 hash of the key is stored. Every lookup is made against that hash, and the console only ever shows a short prefix.
• Each key is either active or revoked. Revoking takes effect straight away. The time a key was last used is recorded, so unused keys are easy to spot.
• Each call is logged against your account: the question (up to 1,000 characters), the outcome, how long it took and approximate token counts. You can see this log in the console.
• API runs count against your plan's monthly research runs. A key is not a way around the allowance.

05Who can see your data

• Runs, projects, saved sources, papers, keys and usage records are tied to the account that created them, and ownership is checked on reads as well as writes.
• Asking for another account's run returns "not found" rather than "forbidden", so run ids can't be probed to see whether they exist.
• A paper is public only if you publish it to the gallery. You can unpublish it.
• Essarion Science admits only addresses on its allowlist. It checks the list on every request made with a session, not just at sign-in, so a session for an address that has been removed stops working. There is no sign-up route to attack.
• Sourcipedia's administration pages are limited to a list of administrator addresses, and administrator changes are recorded in an audit log.

06Transport and headers

The products are served over HTTPS. In production, ResearchAnything also sends Strict-Transport-Security for one year, including subdomains, and sets these headers on every response:

Cross-origin access that uses cookies is limited to each product's own web origins. The developer API endpoints under /api/query accept calls from any origin, but they authenticate with an API key and never with cookies.

07Fetching and uploads

ResearchAnything and Essarion Science fetch pages that come from search results, which they don't control.

• Only http and https addresses are fetched. An address that resolves to a private, loopback, link-local or otherwise non-public network is refused, and every redirect is checked again before it is followed.
• Downloads are size-capped.
• In Essarion Science, files you upload to a study are limited to 64 MB each, stored under a cleaned-up file name in that study's own workspace, and reachable only by the study's owner.

08Your data

The Privacy Policy is the full statement. In short:

• Providers. To answer you, the products send your prompts and relevant content to AI model providers (the Privacy Policy names OpenAI and Anthropic), search queries to a web-search provider (Brave Search, for ResearchAnything), and search terms to academic and scientific databases. Those providers handle it under their own terms. Content already sent to a provider can't be recalled.
• Retention. Account information and content are kept while your account is active or as needed to provide the service. Logs are kept for a shorter period. Deleted content is removed or scheduled for removal, subject to backups that age out.
• Cookies. Only essential cookies are used. There are no advertising or cross-site tracking cookies.
• No selling. Essarion does not sell personal information or use your queries or documents to show you advertising.
• Your rights. To access, correct, export or delete your data, email hello@essarion.com.

09Reporting a problem

If you find a security issue, or think your account has been compromised, email hello@essarion.com. A person will read it.