Security

Accounts and sign-in

• Passwords are stored only as salted scrypt hashes; they are checked against a list of common passwords and a minimum length.
• Sign-in is rate-limited per address and per account, with temporary lockout after repeated failures. Unknown accounts and wrong passwords get the same answer and take the same time.
• Two-step sign-in with an authenticator app (TOTP) and one-time recovery codes. Strongly recommended for every owner.
• Sessions expire after 12 hours, are signed, and can be revoked: changing your password or choosing "Sign out everywhere" ends every session.
• Sensitive actions (exporting or deleting data, creating relay keys, changing password) ask for your password again.
• Passkeys: planned.

Application security

• Every record is scoped to its business in the database query itself; one business cannot read another's data.
• Requests that change data must come from our own site (cross-site request protection), and cookies are HttpOnly and SameSite.
• Strict browser security headers (content security policy, frame blocking, no sniffing, HTTPS only).
• Parameterized database queries, no raw HTML rendering of user content, request size limits.
• The AI assistant can only use a fixed list of actions, cannot delete data and cannot send messages to your customers. Text it reads from customers or documents is treated as data, never as instructions.
• Error messages shown to you never include internal details.

Data protection

• Encrypted in transit (TLS) and at rest by our hosting and database providers.
• Saved API keys are encrypted with a separate key before they are stored, and are never shown again.
• Security-relevant events (sign-ins, key changes, exports, deletions) are written to an audit log that account owners can see.
• You can export or delete all your data yourself in Settings.

Operations

• Automated tests cover the sign-in, access-control and data-isolation rules and run before every release.
• Dependencies are checked for known vulnerabilities before release.
• Our database provider keeps point-in-time backups; backups are deleted on a fixed schedule.
• We keep an incident response plan and will notify affected customers without undue delay.
• SOC 2: we are preparing for an independent audit. We do not hold a SOC 2 report yet. Planned.

Reporting a vulnerability

Email [support email address] with details. Please give us reasonable time to fix a problem before disclosing it, and do not access other people's data. We will acknowledge within [3] business days and will not take action against good-faith research.