Security

All traffic to the app and the API is encrypted with TLS, and browsers are told to use HTTPS only (HSTS).

Secrets we have to store — access tokens for the social accounts you connect, API keys, and two-factor secrets — are encrypted at rest with AES-256-GCM before they reach the database.

• Passwords are never stored: only a salted scrypt hash.
• Two-factor authentication with any authenticator app, with single-use recovery codes stored only as hashes. Platform staff must use it.
• Sessions live in httpOnly cookies that page scripts cannot read; you can see and sign out every device from Settings → Security.
• Sign-in is rate-limited, repeated failures lock the account temporarily, and error messages don't reveal whether an address has an account.

Every workspace has roles — owner, admin, editor, viewer — and the API enforces them on every request, not just the interface. Staff access to customer workspaces is limited to support needs and is audit-logged.

Security-relevant actions — sign-ins and failures, password and two-factor changes, role changes, invitations, ownership transfers, billing changes, data exports and deletions — are recorded with time, actor and IP address. The log is append-only at the database level and kept for 365 days. Owners and admins can review their workspace's log in Settings → Audit log.

Payments are handled by Stripe on Stripe-hosted pages. Card numbers are entered directly with Stripe and never touch our servers.

• A Content Security Policy, clickjacking protection and strict referrer and permissions policies on every page.
• Request validation that rejects unknown fields, and CSRF protection on cookie-authenticated requests.
• Dependencies are scanned for known vulnerabilities in continuous integration and updated automatically.

Automated jobs delete data on a fixed schedule — for example, expired sessions after 30 days and notifications after 90 — and deleted accounts are purged after a 30-day grace period. You can export or delete your data yourself at any time. See the privacy policy for the full schedule.

AI requests go only to the providers on our sub-processor list, which do not train on your content. Workspace owners and admins can switch AI off entirely.

If you believe you have found a security issue, email [SECURITY CONTACT EMAIL] with the details and steps to reproduce. Please give us reasonable time to fix it before disclosing it publicly, and don't access other people's data or disrupt the service while testing. We will acknowledge your report within [RESPONSE TIME] and keep you updated.