Security

Your account

• Passwords are hashed with scrypt at the parameters OWASP currently recommends. We cannot read them, and neither can anyone who steals the database.
• Session cookies are opaque random tokens, HttpOnly, SameSite=Lax and Secure in production. Only a SHA-256 hash of the token is stored, so a database leak cannot be replayed as a login.
• Every state-changing form is protected against cross-site request forgery.
• Permissions are re-checked against the database on every single request. Removing someone from a workspace takes effect on their next click, not at their next login.
• You can revoke every session on your account at once from settings.

Your data

• All traffic is encrypted with TLS. HSTS is enforced with a one-year max-age.
• Data is stored in PostgreSQL and backed up daily, encrypted, with a 30-day retention. Restores are tested on a schedule.
• Every database query is parameterised. There is no string-built SQL anywhere in the application.
• The application ships no third-party JavaScript. Our Content Security Policy allows scripts from our own origin only, which removes the entire class of supply-chain attacks through analytics and tag managers.
• We never see payment card details — Stripe handles payments directly and we store only a customer identifier.

Our scanning

• Scanning is passive and non-intrusive by design. We do not port-scan, attempt authentication, or attempt to exploit anything. Full scanner policy.
• Configuration-exposure probes only run against domains whose owner has proven control with a DNS record.
• Domain owners can request permanent exclusion from scanning by any customer.

Operations

• Structured audit logging on every privileged action, retained for 12 months.
• Rate limiting on authentication, scanning and public forms.
• Automated dependency vulnerability scanning on every change.
• Secrets are held in the environment and never committed to source control.

Reporting a vulnerability

Please use our contact form. We will acknowledge within two business days and keep you updated until it is closed. We will not take legal action against anyone who reports a vulnerability in good faith, gives us reasonable time to fix it, and does not access or modify other people's data in the process.

What we do not claim

We are not SOC 2 certified and we will not imply that we are. We are a small company that has built this carefully and documented it honestly. If a certification is a hard requirement for you, tell us — it affects our roadmap.