Security & data
Exactly what SherLog keeps, how it's protected, and where to report a flaw.
In short. No IP address, browser ID or device fingerprint is ever stored in clear: only keyed one-way fingerprints (HMAC-SHA256) that can be compared, never read back. Verifications are kept 90 days. You can see and delete yours at any time. The verification page shows no ads, and nothing is sold or shared with advertisers.
What SherLog keeps
| Your IP address | Never in clear. An HMAC-SHA256 of it, keyed with a secret that lives on our server, apart from the database: a plain hash wouldn't do, since every IPv4 address can be tried in minutes; without the key, ours can't be. The same goes for the real address your browser shows behind a proxy (WebRTC), and for its network (the /24). |
|---|---|
| Your browser | A random ID kept in your browser (a cookie and its storage), stored the same way: keyed, one way. |
| Your device | A fingerprint worked out in your browser (screen, graphics, languages, time zone...), hashed there, then keyed again here. What it's made of never leaves your browser. |
| The kind of connection | Home, phone network or hosting company -- read from a public table of networks kept on our server (iptoasn.com): your address isn't sent anywhere for it. A phone network's address is shared by thousands of people, so it weighs little. |
| The result | Verified, held, kicked or banned, and when. Moderators see whether an account is linked to another and why (a score, its signs), never an address -- unless a server's SherLog admin turns addresses on in its alerts, which its verification page then says. |
| The SherLog network | Only between servers that opt in: an account banned as an alt on one counts on the others. What's shared is the keyed fingerprints of banned alts -- never who, never which server. |
How long
- A verification: 90 days, then deleted.
- A server's log of verifications and decisions: 90 days.
- A login to this site: 7 days, or until you log out. The Discord token it starts with is dropped at once: we never act on your account.
- On request, at once: see and delete what SherLog keeps about you. Being verified goes with it (you'd verify again to come back). A hold, a kick or a ban stays until it expires: it protects the server that decided it.
How it runs
- Hosted by OVHcloud, in France (Gravelines). The database and its keys stay on that server.
- The database is a file on that server, not a network service: there's no database console to reach from the internet. The dashboard answers SherLog's admin only -- a 404 for anyone else, moderators included.
- Every page is served over HTTPS only (HSTS), runs no script from another site, can't be framed, and checks a token on every form. A moderator's access to a server's page is checked against Discord every minute.
- Every database query is parameterised. The code is tested against its own attacks (
tests/test_security.py) before each release.
Found a flaw?
Tell us before anyone else: through the support server. We answer within 72 hours, fix what's real, and credit you if you'd like.
Fair play: test on your own account and your own servers, don't read or change other people's data, don't slow the service down, and give us time to fix before you publish. Acting in that spirit, you won't hear from us about anything but the bug. Also at /.well-known/security.txt.