Password handling
- TourLedgers uses PBKDF2-SHA256 password hashing with a separate salt for each user.
- The application does not store plain-text passwords.
- Sign-in attempts on tourledgers.com are rate limited per account and per network address.
Security
Protection for artist business records.
TourLedgers uses server-side sessions, protected routes, ownership checks, explicit output allowlists, and private Cloudflare storage to keep artist-business records where they belong.
Sessions
- Login sessions use HTTP-only cookies so client-side scripts cannot read the session token.
- Production session cookies use Secure and SameSite=Lax attributes.
- Logging out deletes the session on the server, not only in the browser.
Protected access
- Dashboard, account, and administrative routes require an authenticated session before private product information is returned.
- Workspace routes on tourledgers.com also require an active lifetime entitlement on the account.
- Administrative actions require an approved account with the configured administrative role and identity.
Data storage
- Account and product records are stored in Cloudflare D1.
- Uploaded booking and advance files are stored in a private Cloudflare R2 bucket. Nothing in the bucket is served by a public URL.
- On tourledgers.com, uploaded files are encrypted with a server-held key before they are written, and downloads of sensitive document types are logged.
Ownership checks
- Authenticated API routes check account ownership before returning or changing artist records, contacts, shows, pitches, files, and reports.
- Cross-account access by identifier, URL, or file link is tested with two separate accounts before each release.
Buyer-facing outputs
- Public artist pages and report links are built from an explicit allowlist of fields. Guarantees, gross, net, merch, expenses, buyer contacts, private notes, internal scores, file keys, and tax or settlement documents are never included.
- Report links use a long random token, can be turned off from the workspace, and return not found once they are off.
- Public artist pages on tourledgers.com are unpublished until the owner publishes them, and they go dark automatically if the owning account loses its entitlement.
Browser protections
- tourledgers.com sends a content security policy with per-request script nonces, strict transport security, frame denial, and no-store caching for private and API responses.
- Private routes are marked noindex and are excluded from the sitemap.
Responsible disclosure
- Security concerns can be sent to philip@philipstengelpresents.com with the affected route and clear reproduction steps.
- Do not access, alter, retain, or disclose information that does not belong to your account.