---
title: "Security & Data — FAQ & Real, Verified Answers | MS WebX"
description: "Where data lives, how it travels, who can reach it, and what gets logged. Real, verified answers straight from the community, always accurate."
canonical: https://mswebx.com/frequently-asked-questions/security-and-data
language: en
robots: index, follow
og_type: website
type: faq-category
language_alternates:
  en: https://mswebx.com/frequently-asked-questions/security-and-data.md
  cs: https://mswebx.com/cs/casto-kladene-otazky/bezpecnost-a-data.md
  de: https://mswebx.com/de/haeufig-gestellte-fragen/sicherheit-daten.md
  es: https://mswebx.com/es/preguntas-frecuentes/seguridad-y-datos.md
  fr: https://mswebx.com/fr/questions-frequentes/securite-et-donnees.md
  hu: https://mswebx.com/hu/gyakran-ismetelt-kerdesek/biztonsag-es-adatok.md
  it: https://mswebx.com/it/domande-frequenti/sicurezza-e-dati.md
  nl: https://mswebx.com/nl/veelgestelde-vragen/beveiliging-en-data.md
  pl: https://mswebx.com/pl/najczesciej-zadawane-pytania/bezpieczenstwo-i-dane.md
  pt: https://mswebx.com/pt/perguntas-frequentes/seguranca-e-dados.md
  ru: https://mswebx.com/ru/часто-задаваемые-вопросы/безопасность-и-данные.md
  tr: https://mswebx.com/tr/sikca-sorulan-sorular/guvenlik-ve-veri.md
  zh: https://mswebx.com/zh/常见问题/安全与数据.md
  ja: https://mswebx.com/ja/よくある質問/security-to-data.md
  ar: https://mswebx.com/ar/الأسئلة-الشائعة/الأمان-والبيانات.md
  ko: https://mswebx.com/ko/자주-묻는-질문/보안과-데이터.md
  pt-br: https://mswebx.com/pt-br/perguntas-frequentes/seguranca-e-dados.md
  hi: https://mswebx.com/hi/अक्सर-पूछे-जाने-वाले-प्रश्न/सुरक्षा-और-डेटा.md
content_hash: sha256:f70e5f01ab5ef7f8666fa3d68bc86883bccc3987c940dd4946db6c5d6134f82d
generated: 2026-08-11
---

> **Machine-readable Markdown rendering.** This is a Markdown representation of a web page,
> served for AI agents and crawlers as a token-efficient alternative to the full HTML.
> Full interactive HTML version: https://mswebx.com/frequently-asked-questions/security-and-data
> Canonical URL: https://mswebx.com/frequently-asked-questions/security-and-data
> Available languages: en, cs, de, es, fr, hu, it, nl, pl, pt, ru, tr, zh, ja, ar, ko, pt-br, hi
> Change detection: `content_hash` is the SHA-256 of this document's Markdown body — everything
> below this block, whitespace-trimmed, excluding the front-matter. Compare it to detect a real
> content change; `generated` moves on every render and is not a change signal.

[ Back to FAQ](/frequently-asked-questions "faq-breadcrumb-link")

# Security & Data

Where data lives, how it travels, who can reach it, and what gets logged.

Who owns the data in a system you build for us?

You do. We process it to run the service you hired us for and for nothing else. It is not pooled with another customer's data, not sold, and not used to advertise to your users. If the relationship ends, the data is yours to take with you.

How is data protected while it travels?

Connections run over HTTP/3, and the domain is on the browsers' preloaded HSTS list — so a browser refuses to talk to it unencrypted even on the very first visit, before any redirect could be intercepted. The key exchange is post-quantum: X25519 combined with ML-KEM-768, chosen so that traffic captured today still resists decryption once quantum computers are able to attack it.

How are passwords, keys and API credentials stored?

Never in source code — that is enforced by the build, not by discipline: code containing a hard-coded secret is rejected before it can be merged. Secrets live encrypted in a settings store and are decrypted at runtime only where they are actually needed, which also means rotating a key is one change in one place instead of a search across a codebase.

What gets logged, and can you tell who changed something?

Yes. Application events, errors and administrative actions are written to the database rather than to text files scattered over servers, so they can actually be searched. Administrative changes record who acted, what was changed and when. A question like "who changed this price last month" has an answer instead of a guess.

How do you handle cookies and consent?

Non-essential cookies are set only after the visitor agrees, the choice is recorded, and every site we build has a page where it can be changed or withdrawn later. Declining is one click, not a hunt through a settings menu — and a visitor who declines still gets a working site.