Security — Encryption, hosting & the browser

RowFold runs on Microsoft Azure in the United States. Traffic is encrypted in transit with TLS, HTTP requests are redirected to HTTPS, and production sends HSTS. The database is Azure Database for PostgreSQL with encryption at rest; file storage is Azure Blob Storage, also encrypted at rest. Requests that change state carry an antiforgery token that is validated server-side, and the application is rate-limited by endpoint class rather than globally, so a burst against one surface cannot exhaust another.