Data Security
How We Handle Data Security
Editorial data — unpublished manuscripts, reviewer identities, author information — deserves careful handling. Here's the practical approach we take.
Access Control
Admin access is granted on a least-privilege basis and reviewed periodically. Credentials aren't shared over insecure channels.
Backups
Automated backups run on a defined schedule and are periodically tested for successful restoration, not assumed valid.
Transport & Storage
HTTPS is enforced site-wide. Passwords are hashed with a modern algorithm (Argon2id where available); we never store plaintext passwords.
Incident Response
Suspected compromises are investigated and contained following a defined process — see our OJS Security & Recovery service.
Audit Logging
Privileged administrative actions are logged so changes can be traced and reviewed.
Responsible Disclosure
We accept and respond to good-faith security reports — see our Responsible Disclosure policy.
No security measure is absolute
We won't claim "100% security" — no provider honestly can. What we commit to is following documented practices, patching known vulnerabilities promptly, and being transparent if something goes wrong.