Security
What actually happens to your resort’s data, in plain terms — not a policy document written to sound reassuring.
Passwords
Passwords are hashed with bcrypt before they’re ever stored — SlopeHQ never has your plain-text password. Every new password is also checked against known data breaches using a k-anonymity method: only the first five characters of a hash are ever sent for the check, never the password itself or the full hash.
Transport security
The entire site runs over HTTPS with HSTS enabled, so browsers refuse to fall back to an unencrypted connection. Every page is served with a strict Content-Security-Policy, which limits what scripts and resources are allowed to run at all.
Sessions
Session cookies are set HttpOnly, Secure, and SameSite — they can’t be read by page scripts and are never sent over an unencrypted connection.
Detection & location privacy
SlopeHQ never uses GPS or location tracking. The app only recognizes your own resort’s registered clock-in device, and only while it’s open in the foreground — never in the background. This is disclosed to every staff member before detection is ever turned on, not just in a policy document.
Data isolation & storage
Every resort’s data — staff, departments, shifts, messages, reports — is scoped to that resort at the database level; there’s no cross-resort query path. Data is stored on managed Postgres infrastructure with encryption at rest.
See also the Privacy Policy and Terms of Service. Questions? hello@slopehq.app