How we protect your account and your credentials.
CraftCred's entire premise is that a credential should be trustworthy. That starts with protecting the accounts and records those credentials are built on.
Session tokens you can't script-steal
Login sessions are stored in httpOnly cookies, not in browser storage or a JavaScript-readable token. A cross-site script running on a compromised page cannot read or exfiltrate them the way it could a token kept in localStorage.
CSRF protection on every state-changing request
Requests that change data are checked against a separate CSRF token before they're accepted, so a malicious site can't trigger actions on your account just by getting you to visit a page.
One-time codes, hashed at rest
OTP codes used for verification are stored as hashes, not as plain six-digit values -- even direct database access wouldn't reveal a usable code. Refresh tokens rotate on every use, and resetting your password immediately signs out every other active session on your account.
Rate limiting on sensitive endpoints
OTP requests, OTP verification, password resets, public credential verification, and the public contact form are all rate-limited, to slow down automated abuse rather than relying on limits alone as a full defence.
You control what your public profile shows
Your CraftCred public profile defaults to privacy-conscious visibility settings, and you decide whether to show trust score, portfolio, work stats, location, credentials, or association memberships -- or to keep the whole profile private.
See and revoke your own sessions
The Security section of your account settings shows your active login sessions, so you can review them and sign out any device you don't recognize.
Credential integrity
A CraftCred credential is never just a self-reported claim. It's issued by a master craftsman directly, or reviewed and signed off by a trade association through the association-certified flow -- a real person accountable for the credential they issue. Every credential carries a unique code that anyone can check independently on the public verify page, without needing to trust the profile it's attached to.
Work records follow the same principle: a job only becomes a verified work record once the employer or client who hired the worker confirms it -- not from the worker's own claim alone.
For how we handle personal data, see our Privacy Policy. Found a security issue? Please tell us before disclosing it publicly -- contact us and we'll follow up directly.
Build a record worth trusting.
Create a free account and start building a credential history that holds up to scrutiny.