OkCupid considers the security of our applications and the privacy of our users' data extremely important. While it is impossible to predict the full range of future cyber threats against our systems, we regularly assess and work to improve our security in an effort to enhance the safety of our user community.

Security practices

OkCupid employs physical, logical, and operational controls to ensure appropriate protection of our systems and user data. Our security program is focused on the following domains:

Information Security and Identity & Access Management: We strive to increase security and reduce risk within OkCupid’s environment. In order to do so, we proactively build secure access protocols and network architecture to enable systematic control of internal access to our facilities, systems, and resources, using the least privilege paradigm.

Application and Infrastructure Security: Security is engineered and integrated at all levels of our development lifecycle to help enable the creation of better, safer products, as well as to ensure secure design and engineering principles.

Governance, Risk, and Compliance: Security awareness begins on day one and it is a continuous process thereafter. All employees undergo security and privacy training the moment they start as well as annually. We enforce security policies and procedures to secure our systems and user data. In addition to performing extensive internal security risk assessments, we also perform in-depth reviews of the security posture of our third-party vendors as well before onboarding them into the environment.

Red Team / Offensive Security: Our internal Red Team identifies security vulnerabilities in existing systems and workflows through offensive security testing. This group simulates real-world attacks on all areas of the company and prioritizes up-leveling security posture to address areas of greatest risk. Our goal is to gain insight into potential exposures and to continuously test to reduce the likelihood of a breach.

Monitoring and Threat Management: Access to our infrastructure and systems is continuously logged and monitored. Our security program includes proactive monitoring, threat detection, investigation, and incident response to ensure that security events are promptly identified, triaged, investigated, and remediated appropriately.

Reporting security vulnerabilities

OkCupid welcomes input from the security research community in identifying potential issues and ways to improve the security of our applications, infrastructure, and user data. We encourage security researchers to responsibly disclose any potential vulnerabilities uncovered here. To protect our users, we also request that you please refrain from sharing information about any potential vulnerabilities with anyone outside of OkCupid until we have had the opportunity to review and address them. We appreciate your help in keeping OkCupid secure for our users.

Note that we explicitly prohibit testing Denial of Service (DoS) or use of automated scanning tools against any of our applications or infrastructure.

For questions, concerns, issues with your profile, or to report another user or profile, please visit our support page.