How this is locked.

Connection

peza.club is served over HTTPS. Do not enter information on a page that the browser marks as not secure.

Banks

We never ask for a bank password. peza does not connect to your bank, and it has no read access to an account balance or a statement.

The waitlist

The browser cannot read or write the waitlist. Firestore security rules deny every client read and every client write. A signup is accepted only by the submitWaitlist Cloud Function, which writes with a server credential.

The document id is a hash of the email address, not the address itself. The address is stored as a field so we can write to you. The function checks the address, rejects unexpected fields, and limits how often a network can submit.

City and country are looked up on the server. The connection address used for that lookup is not written to the waitlist.

Unsubscribe

The unsubscribe link carries a signature made with a secret held in Google Secret Manager. A link with a missing or invalid signature is rejected, and the page does not say whether that address was on the list. Opening the link shows a confirmation page. You are unsubscribed only when you submit that page, or when your mail app sends the one-click request.

Secrets

The key used to send email, and the key used to sign unsubscribe links, are stored in Google Secret Manager. They are not in the website and they are not in the pages you download.

Reporting a problem

If you find a vulnerability, email support@peza.club. Describe what you found and how to reproduce it. Please give us a reasonable time to fix it before you publish the details. We do not run a paid bug bounty.

What this page is

This page describes the controls we run. It is not a penetration-test report, and it is not a certification.