Security
Horizon Europe proposals contain unpublished ideas, budgets and personal data. Stellate protects them with several independent layers, so that a failure in one is caught by another.
How your data is protected
| Layer | What we do |
|---|---|
| Sign-in | Passwords of at least 12 characters, checked against common and breached passwords, hashed with bcrypt. Two-factor authentication with an authenticator app and one-time recovery codes; organisations can require it for all members and it is mandatory for site administrators. Accounts lock after repeated failed attempts. Email alerts for new sign-ins and lockouts. |
| Sessions | Random session tokens stored only as hashes; HttpOnly, Secure, SameSite cookies; sign-out after 12 hours of inactivity and after 14 days at most; see and sign out your devices on the Account page. |
| Access control | Every request checks your role in the organisation and project. Invited partners see only the projects they were invited to. Invitation links are single-use, expire after 14 days and are bound to the invited email address. |
| Encryption in transit | HTTPS only, TLS 1.2 and 1.3, HSTS. |
| Encryption at rest | Project content, two-factor secrets and every uploaded file are encrypted with AES-256-GCM, which also detects tampering. Backups are encrypted separately. Keys are kept apart from the data. |
| Uploads | Executable and script files are refused; files are scanned for malware when antivirus is enabled; downloads are sandboxed so a file can’t run code in your browser. |
| Web application | Strict Content Security Policy with no third-party scripts, fonts or trackers; protection against cross-site request forgery and clickjacking; rate limits; sensitive responses are never cached. |
| Security log | Sign-ins, failed attempts, permission changes, exports, downloads and administrative actions are recorded. Each entry is chained to the previous one with a keyed hash, so changes to the log can be detected. Organisation owners and admins can review their organisation’s log. Kept for 365 days. |
| Infrastructure | Hosted in [EU region]. The database runs on an isolated network with no internet access. Containers run without administrator rights and with read-only file systems. Firewall, automatic security updates and brute-force protection on the servers. |
| Resilience | Nightly encrypted backups kept for 30 days and copied off-site; restore tested. |
| Privacy by default | AI drafting is off until your organisation turns it on; no analytics or advertising; full export and deletion of your data at any time. |
EU classified information
Stellate is not accredited to process EU classified information (EUCI) or national classified information. Don’t upload such information. Proposals that involve classified information must follow the security procedures in the call and the Programme Guide.
Report a vulnerability
If you believe you have found a security vulnerability, email [security email]. Please give enough detail to reproduce it, don’t access or change other people’s data, don’t disrupt the service, and give us reasonable time to fix it before disclosure. We acknowledge reports within 3 working days and keep you informed. We won’t take legal action against good-faith research that follows these rules. Our contact is also published in security.txt.
Incidents
If an incident affects your data, we notify affected customers without undue delay and within 48 hours of becoming aware of it, and the supervisory authority where the GDPR requires it.