Security and data protection
This section is for business owners, managers and the person who answers for customer data in a small or mid-sized organization. It explains in plain words what Exponential already does to protect a site and its data, what you must decide and do yourself, and where the technical pages are for whoever does the work.
Warning
These pages are basics, not legal advice. Whether your site complies with the GDPR or any other law depends on what you process, why and for whom. Read the regulation text itself, and take advice from a lawyer or your data protection officer (DPO). The project's own pages say the same (Compliance and GDPR).
Contents
- What this section covers
- The pages
- A suggested order
- What Exponential does by default
- Neighboring sections
What this section covers
- The security basics every business site needs, and who does them.
- The GDPR in outline, and how the software helps you meet your duties.
- Where personal data sits inside an Exponential installation.
- Consent for mail and forms, accounts and passwords, and reviewing who has access.
- Security updates and how to report a vulnerability privately.
- How long data is kept, how it is deleted, and how to show evidence with the audit trail.
The pages
| Page | What it answers |
|---|---|
| Security basics for businesses | The ten things a business must have in place, and who does each |
| GDPR basics | The principles in outline and the software features that support them |
| Personal data in Exponential | Where accounts, orders, form data, newsletter subscribers, logs and the audit trail are stored |
| Consent and forms | Mail consent, double opt-in, unsubscribe, forms that collect data |
| User accounts and passwords | Password rules, two-step sign-in, password changes, account hygiene |
| Access reviews | A yearly check of who can do what, step by step |
| Security updates and disclosure | Supported versions, applying fixes, reporting a vulnerability privately |
| Data retention and deletion | How long logs and records are kept, and how to delete on request |
| Compliance evidence from the audit trail | Using the tamper-evident audit trail as proof |
A suggested order
- Security basics for businesses: the overview.
- Personal data in Exponential: know what you hold.
- GDPR basics and Consent and forms: your duties towards people.
- User accounts and passwords and Access reviews: who gets in.
- Security updates and disclosure: staying safe over time.
- Data retention and deletion and Compliance evidence from the audit trail: proving it.
What Exponential does by default
| Protection | Source |
|---|---|
| Passwords stored as bcrypt hashes; common passwords refused | Security hardening |
| Security headers on every page, including the administration | Security and audit |
| A Content Security Policy, report-only on the administration | Content Security Policy |
| A tamper-evident audit trail, on by default | The audit trail |
Client addresses masked in request logs (MaskIP=enabled) | Compliance and GDPR |
| Optional mail only with consent, one-click unsubscribe | E-mail preferences |
| No installer leaves the old default administrator password | The default administrator password |
Two-step sign-in available through sevenx_authentication_2fa | Two-step sign-in |
The defaults are a strong start. The decisions about your data, your people and your contracts remain yours.
Neighboring sections
- Reliability: backups, restores and incident response.
- Stores: security checklist and Card payments and PCI basics.
- Newsletters: opt-in and consent.
- Costs and Choosing hosting and partners.
- Governments have their own section: Governments: start here.
Related pages
- Security hardening
- Security and audit guide
- Accessibility, security and compliance checklists
- Security for hosts
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.