Security and Trust

RateTheLeader.com™ holds personal information and the private views of team members. This page sets out how the platform protects both.

How the data is protected

• Encrypted in transit

  Every page is served over HTTPS only. A visit on plain HTTP is moved to HTTPS before anything is sent.

• Personal information encrypted in the database

  Email addresses, names, mobile numbers, dates of birth, job titles, company names and the optional profile fields are encrypted with SQL Server Always Encrypted, using AES 256. The keys are kept on the web server, never in the database, so a copy of the database or a backup shows only scrambled values.

• Raters stay anonymous

  Answers are stored under a random key, with no name or account on them. Nothing shows who took part, only how many. Detail per question needs at least 3 raters.

• Consent first

  No rating starts without the leader's consent to that request. Only the leader's direct reports rate the leader.

• Results for the leader only

  The result, the scores and the report are shown only to the leader, and only after the report is bought.

• Passwords and PINs never stored

  Passwords and badge PINs are kept only as bcrypt hashes, each with its own salt. A PIN is also mixed with a secret kept outside the database.

• An audit log that cannot be changed

  Logins, failed logins, changes, settings and exports are written to an audit log. The portal can add to it but cannot change or delete it, and each entry is sealed to the one before, so a daily check finds any gap.

• Card details never stored

  The platform never stores card details.

Built to the OWASP Top 10

The OWASP Top 10 is the best known list of the most common weaknesses in web applications. This is how each one that applies is closed on the platform.

• SQL injection

  Every database call goes through a stored procedure with typed parameters. What a person types is never built into a database command.

• Access control

  Every page that shows a person's data checks that the person logged in may see that record. Staff see only the console topics the Master User gives them.

• Encryption

  HTTPS for every page, AES 256 Always Encrypted for personal information, and bcrypt for passwords and PINs.

• Logins

  Repeated failed logins lock the account for a short time. Login and Forgot Password never say whether an email address has an account. A password reset link works once, expires after 2 hours and is stored only as a hash.

• Too many attempts

  Login, registration, Forgot Password, rating requests and invitations accept only a few attempts in a short time from one place.

• Forged forms

  Every form carries a hidden security token, so another website cannot send a form in a person's name.

• Browser protection

  The browser is told to run scripts from RateTheLeader.com only, and other websites cannot show its pages in a frame. Login cookies are Secure, HttpOnly and SameSite.

• Errors and logs

  Errors are logged on the server. A visitor sees a plain message, never technical detail.

This page describes the platform as it is today. It is updated as security features are added.