Trust & Security

Last updated: January 2026

How Sema Store protects accounts, payments, and purchased files.

1. Accounts

Passwords are bcrypt-hashed. Sessions use signed JWTs in HTTP-only cookies. Password reset tokens are single-use, SHA-256 hashed at rest, and expire after one hour.

2. Payments

Payment status changes are provider-verified and idempotent. Prices are recalculated server-side at checkout — client totals are never trusted.

3. Downloads

Paid files live in private object storage. Downloads are proxied by the API only after an entitlement check — there are no permanent public URLs for paid assets.

4. Moderation

Every product is reviewed before publication. Admin actions are audit-logged, and back-office access is permission-scoped.

Questions about this policy? Contact support.