Data Security

• Sessions are managed by our authentication provider using signed, HTTP-only cookies — your session token is never readable by page scripts.
• Passwords are hashed by our authentication provider; OpenCourt never stores or sees a plaintext password.
• All traffic between your browser and OpenCourt is encrypted over HTTPS/TLS.

We never handle raw card numbers or e-wallet credentials. Checkout happens on our payment processor’s own PCI-compliant checkout page. OpenCourt’s servers receive only a payment reference and a status (paid, failed, refunded), never your card or account number.

• The application database is only reachable through our application layer; direct public access is disabled, and row-level security policies restrict what each type of request can read or write.
• Database connections use TLS.
• Uploaded images are re-encoded on our servers before storage, which also strips embedded file metadata.
• Backups are taken before any structural change to the database.

Production credentials and secrets (database URLs, API keys, signing secrets) are stored as write-only environment variables in our hosting provider’s dashboard, not in source control, and not shared over chat or email. Internal access to production systems is limited to the people who operate the platform.

We monitor for unusual activity and known vulnerabilities in our dependencies. If we become aware of a breach involving your personal data, we’ll notify affected users and the National Privacy Commission as required under the Data Privacy Act of 2012.

• Use a strong, unique password for your OpenCourt account.
• Never share your payment transaction reference or one-time codes with anyone claiming to be OpenCourt support.
• On Pasalo, only ever pay the account shown on the claim page, never a number given to you in chat.

Found a security issue? Email help@opencourt.ph with details. We ask that you not access or modify other users’ data, and give us a chance to fix it before any public disclosure.