Security

Where your data lives

RacingOwl runs on Google Cloud in Mumbai, India. Your courses, your learners and your progress are stored in a database there and nowhere else. Google's data centres are independently certified (ISO 27001 and SOC 2) for physical security, staff access and operations.

To be clear about what that does and does not mean: those certificates cover Google's buildings, hardware and network. RacingOwl itself, the software running on top of them, is not separately certified. What we do to protect it is set out below.

Every site is kept separate

Many sites share one RacingOwl. No site can see another site's learners, courses, sales or messages, and no learner can see another learner's progress, certificates or invoices.

This boundary is enforced inside the database itself, not only in the application on top of it, so a mistake in our code cannot open it. An automated test tries to cross it, in both directions, every time we change anything, and nothing goes live if that test fails.

Encryption, in transit and at rest

Every page and every request is served over HTTPS. Older, weaker versions of the encryption protocol are refused, and browsers are told to use HTTPS for RacingOwl and every site's address for a year at a time. The database and its backups are encrypted at rest by Google Cloud.

Payments and card details

Payments are handled by Razorpay, which is certified to the highest level of the card industry's security standard (PCI DSS Level 1). Card numbers, UPI details and bank credentials are entered on Razorpay's secure form and go directly to Razorpay. They never pass through, and are never stored on, RacingOwl's servers. We keep a record of what was bought, when, and for how much; we could not see a card number if we wanted to.

Every message Razorpay sends us about a payment is checked against a cryptographic signature before it is believed, so a forged “payment received” cannot unlock a course.

Passwords and signing in

We never store your password. What we store is a slow, salted, one-way hash of it (scrypt), which cannot be turned back into the password. Passwords must be at least ten characters; we do not force patterns like “one symbol, one number”, because length is what actually makes a password hard to guess. We do not make you change your password on a schedule: that habit produces weaker passwords, not stronger ones.

Repeated wrong guesses lock the account for a while, and a single address making many sign-up or reset requests is slowed down. You can sign in with Google instead of a password if you prefer. Signing out signs you out everywhere at once, on every site, which matters on a shared computer.

Backups

The database is backed up automatically every night and the last fourteen backups are kept. Between backups every change is logged, and those logs are kept for seven days, so the database can be put back to a chosen minute rather than only to last night: the most that could be lost is a few minutes. Restoring from a backup has been rehearsed. The database cannot be deleted by accident; deletion protection is switched on.

Who can see your information

A trainer sees the learners on their own site and nothing beyond it. A learner sees their own progress, certificates and invoices. RacingOwl staff can see what is needed to run the service and help when something goes wrong, and a small number of actions in the staff console are recorded with who did them.

A private chat between a learner and a site is seen by that learner and by the people who run that site, and by nobody else on it. RacingOwl staff read one only when a learner reports the chat to us, or when a message matches a dangerous-language pattern and is held for review — the same rule as for discussions.

We do not sell personal information, we do not run advertising, and we refuse the crawlers that collect course content to train AI models. The privacy policy says exactly what is collected and for how long it is kept.

How we test

Every change to RacingOwl runs through several hundred automated checks before it can go live. Among them is a list of attacks a security tester would try: a session from one site replayed on another, a learner reaching for a trainer's pages or another learner's certificate, forged payment callbacks, tampered sign-in tokens, and what a stranger with no account can read. If any of them succeeds, the change does not ship.

Once a week an automated security scanner (OWASP ZAP) crawls racingowl.com and checks every page for known classes of weakness. RacingOwl is checked every five minutes from six locations, and we are alerted within minutes if it is down.

Reporting a problem

If you find a security problem with racingowl.com or any site on it, please tell us before telling anyone else: write to support@racingowl.com. We will acknowledge within two working days. We will not take action against anyone who reports in good faith and gives us a reasonable chance to fix the problem first. The same details are published in the standard place, at /.well-known/security.txt.

If we ever learn that personal information has been exposed, we will tell the people affected and the authorities that Indian law requires us to tell, and this page will say what happened.

In short

• Your data is in India, on Google Cloud, encrypted.
• Sites cannot see each other; the database enforces it.
• Card details never touch our servers.
• Passwords are never stored, only hashed.
• Nightly backups, the last fourteen kept, and recovery to a chosen minute.
• Attacks are rehearsed on every change and RacingOwl is scanned weekly.
• An outside test has not been done yet.

Questions about any of this: get in touch.