Security

Data Protection

• Encryption in transit: every page is served over HTTPS, with HSTS so browsers keep to HTTPS on every later visit.
• Encrypted secrets: TOTP secrets, and the payment-processor API keys we store, are encrypted in the application with AES-256-GCM. Card numbers go to Stripe and never reach us.
• Data Processing Agreement: an organization admin accepts our Data Processing Agreement for the organization before any governance records can be created or changed. Organization setup (profile, members, sign-in and integration settings) can be done first.

Authentication & Access Controls

• Multi-factor authentication: authenticator apps (TOTP) and passkeys.
• Single sign-on and provisioning: SAML single sign-on and SCIM user provisioning.
• IP allowlist: each organization can restrict access to the IP addresses it allows.
• Role-based access: admin, contributor and auditor roles decide what each member can see and change.
• Sessions: session cookies are Secure, HttpOnly and SameSite=Strict.

Audit Log

Actions on the platform are written to an audit log in which each entry is hash-chained to the one before it, so a later change to a recorded entry is detectable unless it is made by someone holding the application's signing key and database access. That makes the log tamper-evident. It is not immutable, and we do not describe it as such.

Incident Response

What we commit to if a personal data breach affects your data is set out in the breach notification section of our Data Processing Agreement.

Reporting a Vulnerability

We welcome vulnerability reports from security researchers and customers at [email protected]. Please include enough detail for us to reproduce the issue. Coordinated disclosure preferred.