Passwords hashed with scrypt
Credentials are stored as scrypt hashes (N=16384, r=8, p=1) with a unique 16-byte salt per password and constant-time comparison. Plaintext passwords never touch the database.
Security
Your chapter’s data, defended like it matters.
A roster is names, addresses, payment history, and event attendance, exactly the data attackers want. Here’s what protects it, stated precisely enough to check.
Brute-force lockouts
Admin sign-in locks out after 5 failed attempts, and sensitive API endpoints are rate-limited per client. Automated guessing gets nowhere.
Session kill on removal
When a member is expelled or deactivated, their sessions are revoked immediately, a status flip alone isn't enough.
Audit trails
Sensitive actions are written to an audit log, so there's always a record of who changed what.
No third-party sign-in
GreekStack uses no Google, Facebook, or Apple sign-in anywhere. One fewer identity provider in the chain means one fewer place your data can leak.
Honest auth model
The officer console signs in with a single shared chapter credential, deliberately simple for a rotating e-board, and disclosed up front rather than hidden behind 'team' marketing. We'll tell you what the model is and let you decide.
Report a vulnerability
Found something? We’d rather hear it from you than discover it ourselves. Tell us what you found and how to reproduce it, we’ll acknowledge receipt within 48 hours and keep you posted on the fix. Please don’t test against other chapters’ live data.
What we don’t claim: this page describes our application controls. It is not a SOC 2 report, and we don’t pretend it is. Full terms: Terms of Service.
Launch on GreekStack today
Spin up a recruitment and management site in an afternoon. Charged at signup: no trial, no free month. No developer needed, and you can leave on your terms.
Prefer to ask first? Ask us directly, a real person answers.