Security

Last reviewed: July 6, 2026

A press release is a strange asset: worthless after publication, potentially market-moving before it.

Your unannounced funding round, acquisition or product launch sits on our servers before the world knows.

Here's exactly how we treat that responsibility.

Encryption In Transit

All traffic to prdistribution.co — pages, forms, the API — runs over TLS (HTTPS).

Drafts and embargoed releases never travel in plain text.

Credential Protection

Passwords are hashed with bcrypt via PHP's password_hash() — one-way, salted, never stored or logged in plain text.

Not by us, not by support, not anywhere.

If you forget your password, we reset it; we can't read it.

Session Security

Three protections:

Sessions use HttpOnly, SameSite cookies (inaccessible to injected scripts)
Session IDs regenerate at every login to block fixation attacks
State-changing forms carry CSRF tokens

The free AI tools add rate limits and captcha to keep automated abuse off the platform you're sharing.

Payments

Card payments are processed by PCI-DSS-compliant payment providers.

Card numbers never touch our servers — we store only the order record.

Editorial Safeguards

Security isn't only infrastructure.

Every release passes AI checks plus human editorial review before publication — which means scams, malware links and impersonation attempts don't enter the network.

That protects readers, and it protects you: your announcement never shares a network with content that would embarrass it.

Embargo Handling

Scheduled releases stay private until their go-live time.

Access before publication is limited to the editorial staff who review them, under least-privilege access controls.

No pre-publication content is ever shared, indexed or used for anything except getting your release ready.

Infrastructure

What's in place:

Least-privilege access for staff
Isolated storage for credentials and secrets (never committed to code)
Regular off-site backups so a hardware failure doesn't become your problem

Responsible Disclosure

Found a vulnerability? We want it. Email [email protected] with "SECURITY" in the subject line:

We acknowledge within 72 hours and keep you updated through the fix.
Good-faith research gets safe harbor — no legal action for responsible testing and reporting.
Please don't access other users' data, degrade the service, or disclose publicly before we've fixed it.