Security
How we keep your account safe
Real, specific facts about how Learnsable is built — not a badge wall.
Last updated 3 October 2026
Signing in
- Passwords are stored only as Argon2id hashes — a deliberately slow, modern algorithm. We never store or see your actual password.
- Sign-in sessions use short-lived tokens (15 minutes) in cookies scripts can't read, renewed by a separate token that's replaced on every use. A renewal token that's used twice ends the whole session, so a stolen copy is useless.
- After 8 wrong passwords, an account locks for 15 minutes; sign-in codes are rate-limited too. Where we store the email or phone a code was sent to, it's encrypted.
- Every change you make is protected against cross-site request forgery, and changing your password signs out your other devices.
Your data
- Everything travels over HTTPS, and browsers are told to always use it (HSTS).
- Every request is checked against your own account on the server — one student can never open another's data, even by guessing an ID.
- Files you upload to Notes are stored privately with Amazon Web Services in Mumbai, India, and opened only through short-lived signed links.
- The PDF Toolkit (merge, split, rotate, watermark and more) runs entirely in your browser — those files never reach our servers.
- Files attached in chat or to a PDF question go to the AI to answer you and aren't kept as files.
Payments
- Payments are handled by Cashfree Payments. Card numbers, UPI PINs and bank logins go directly to Cashfree — never through our servers.
- The amount you pay is always taken from our own price list on the server, never from your browser, so it can't be tampered with.
- A plan or credits are added only after Cashfree itself confirms the payment, through signed notifications we verify.
Behind the scenes
- Our AI and payment keys live only on the server and are never sent to your browser.
- A strict Content Security Policy limits which scripts can run on our pages.
- We run no third-party analytics or ad-tracking scripts.
More about what we collect and why is in our Privacy Policy.
Found a security issue?
Please email support@dhronaai.com with the details — we'd rather hear it from you first, and we'll respond quickly.