Trust center
Security controls and operating boundaries
A factual view of the service’s current controls, with roadmap work clearly separated from finished protections.
Control register
Current controls
Status reflects the production controls reviewed September 28, 2026. Planned integrations stay outside the trust boundary until their own security gates pass.
Operational
No secret-value fields
Product and account forms accept lifecycle metadata and structured business details only.
Operational
Tenant isolation
Forced PostgreSQL row-level security rechecks organization scope beneath the application.
Operational
Hardened identity
Short-lived opaque sessions, secure host-only cookies, password hashing, throttling, and TOTP MFA.
Operational
Append-only audit history
Security-relevant workspace changes create immutable, actor-attributed audit records.
Operational
Separated service roles
Runtime, worker, migration, and backup processes use distinct database identities and grants.
Off-host drill passed
Restore rehearsal
An off-host drill passed September 7: B2 download, age decryption, checksum validation, and an isolated PostgreSQL restore.
Operating boundary
Operations and recovery
Access controls separate workspaces, encrypted backups support recovery, and restore rehearsals check the running application and tenant isolation. Our security architecture explains the controls and their limits.
Read the security architecture- Product data
- Identity, ownership, provider, environment, policy, and lifecycle dates—not the credential itself.
- Monitoring
- Host and application checks run every five minutes; lifecycle alert work runs separately from web traffic.
- Backups
- Nightly local database/source backups plus an encrypted Backblaze B2 copy for total-host loss.
- Delivery and integrations
- Amazon SES and encrypted email retries are configured. Workspace alert activation and end-to-end inbox checks are part of onboarding. Provider integrations remain planned; payment card details are handled by Stripe.
Responsible disclosure
Found a security issue?
Send a concise report with impact and reproduction steps. Do not include live credentials or access data you do not own.