Security & Upload Safety

1. Layered security

PRAELIQ uses administrative, technical, and organizational safeguards appropriate to its founding stage. These safeguards reduce risk but no online service or upload filter can guarantee detection of every attack, error, or previously unknown malware strain.

2. Accounts and private functions

• Member access uses verified email and time-limited sign-in codes.
• The private member dashboard is separated from public profiles.
• Sensitive member requests are checked against trusted request origins.
• Private responses use no-store caching and browser protections against framing, content-type sniffing, unnecessary permissions, and referrer disclosure.
• Integration credentials are held in protected environment variables and are not intended for public pages, screenshots, or documents.

3. Upload screening before storage

Supporting evidence is screened on the server before it is stored. PRAELIQ currently accepts PDF, PNG, JPG/JPEG, and WEBP files up to 5 MB. The filename extension, declared content type, and detected file signature must agree.

• Executable, archive, HTML, SVG, script, PHP, JavaScript, malformed, disguised, and unsupported files are rejected.
• PDFs containing active or embedded content, JavaScript, launch actions, rich media, XFA, encryption, automatic actions, missing end markers, or suspicious appended payloads are rejected.
• Image dimensions are validated, and images above the current safety threshold are rejected.
• Rejected files are not stored. The written recognition remains available so the user can cancel the attachment, choose another eligible file, or submit without evidence.

4. Private evidence

Accepted evidence is stored privately and may be accessed only through an authenticated profile-owner workflow. Protected download headers reduce browser content-type risks. A member may remove evidence without deleting the written recognition.

5. Recognition and abuse controls

Recognition is not published automatically. The receiving member reviews and approves or privately declines submissions. PRAELIQ also uses consent requirements, content limits, a bot-deterrence field, submission thresholds, and community moderation.

6. Payments and webhooks

Stripe hosts payment-card entry and the billing portal. PRAELIQ does not ask customers to send full card numbers by email. Stripe webhook signatures are verified using a protected signing secret, and duplicate-event processing protection is active.

7. Reporting a concern

Report suspected account misuse, unsafe content, malicious files, impersonation, privacy concerns, or unauthorized payments to info@praeliq.com. Do not attach the suspected malicious file. Include the affected page or profile, approximate time, and a plain-language description.

Questions

Email info@praeliq.com or visit the PRAELIQ contact page.