Security at Used Domain

Domains are long-term assets. This page describes the concrete practices we use to protect accounts, payments, and the domains themselves.

Transport & data

All traffic is served over HTTPS.
Passwords are stored as salted hashes (bcrypt), never in plain text.
Sessions and one-time links are stored as hashes — the raw token exists only in your browser or inbox.
Provider credentials live in environment/secrets management, never in the codebase or the database.

Sign-in via magic link, Google, or password — your choice.
Step-up authentication: sensitive actions (transfers, auth codes, contact changes) require recent re-authentication.
Active sessions and sign-in history are visible in your dashboard, and you can revoke sessions individually.
Rate limiting and bot protection (Cloudflare Turnstile) on abuse-prone endpoints.

Payments are processed by established providers (card, PayPal, crypto) — card data never touches our servers.
Payment confirmation is server-authoritative: orders change state only on verified, signed webhooks, never on browser redirects.
Wallet balances are an append-only ledger — every credit and debit is a recorded entry, not an editable number.

Registrar lock is available and encouraged for every domain.
Transfer and auth-code requests are treated as high-risk operations with step-up authentication and a full audit trail.
DNS changes are snapshotted, so you can review and roll back record history.
Every operation — registration, renewal, DNS change, lock — is recorded durably with an idempotency key, so retries never duplicate an action.

If you believe you have found a vulnerability, please report it via our contact page with “Security” in the subject. We investigate every report.

No fake countdowns or scarcity banners.

No fabricated certifications or trust badges.

No availability “results” that did not come from the registrar.

No silent state changes — every operation is logged.