Trust center
What is protected, what is excluded, and what comes next.
A factual view of the private pilot’s current controls, with roadmap work clearly separated from finished protections.
Control register
Controls you can evaluate today.
Status reflects the production pilot reviewed September 6, 2026. Planned integrations stay outside the trust boundary until their own security gates pass.
Operational
No secret-value fields
Product and pilot forms accept lifecycle metadata and structured business details only.
Operational
Tenant isolation
Forced PostgreSQL row-level security rechecks organization scope beneath the application.
Operational
Hardened identity
Short-lived opaque sessions, secure host-only cookies, password hashing, throttling, and TOTP MFA.
Operational
Append-only audit history
Security-relevant workspace changes create immutable, actor-attributed audit records.
Operational
Separated service roles
Runtime, worker, migration, and backup processes use distinct database identities and grants.
Before beta
Restore rehearsal
Local and encrypted offsite backups are active; a documented recovery drill is the remaining beta gate.
Operating boundary
Production is intentionally small and legible.
The private pilot runs as an isolated application and PostgreSQL service on the production VPS. Public traffic terminates at Nginx over TLS; the database has no public port.
Read the security architecture- Product data
- Identity, ownership, provider, environment, policy, and lifecycle dates—not the credential itself.
- Monitoring
- Host and application checks run every five minutes; lifecycle alert work runs separately from web traffic.
- Backups
- Nightly local database/source backups plus an encrypted Backblaze B2 copy for total-host loss.
- Dormant dependencies
- Provider connections, automated email, and live billing remain disabled until configured and validated.
Responsible disclosure
Found a security issue?
Send a concise report with impact and reproduction steps. Do not include live credentials or access data you do not own.