Effective 1 September 2026. Larp uses layered operational and technical controls to protect the service and organization-scoped advertiser data.
Access and application security#
Authentication, session protections, role-based organization access, input validation, dependency maintenance, and restricted administrative privileges reduce unauthorized access. Production access is limited to personnel who need it for operations and support.
Data protection#
Traffic is encrypted in transit. Secrets and payment credentials are kept out of application content and access is logged where appropriate. Data is backed up and recovery procedures are maintained. We review platform-staff access used to assess campaign completions.
Payment integrity#
Money is represented as integer cents. Wallet credits occur only after Larp validates a signed Stripe webhook; browser redirects and return URLs never credit funds. Stripe handles payment-card processing through its systems.
Monitoring and response#
We monitor service health, authentication activity, and operational errors, triage suspected incidents, contain affected systems, restore service, and notify affected customers when required. No online service can eliminate all risk.
Your responsibilities#
Use unique credentials, enable available authentication safeguards, review organization membership, remove stale access, and report suspicious activity promptly. Never send passwords or secret keys by support email.
Reporting a vulnerability#
Send a clear report to hello@larp.ad before public disclosure. Include affected URL, impact, and reproducible steps. Do not access unrelated data, disrupt service, use social engineering, or retain personal information while testing.