Last updated 2026-08-16
Security
Draft — pending counsel review. The facts are current; the wording is not final.
What protects your work today. Written by the people who run it, not a template.
Transport and sessions
Everything is served over TLS. Sessions are random tokens in HttpOnly, SameSite cookies; changing your password signs out every other session, and a password reset signs out all of them.
Tenancy
Every table carries a workspace id and every query is scoped by it — enforced by an automated test, not convention.
Passwords and sign-in
Passwords are hashed with bcrypt. Credential endpoints are rate-limited. Google sign-in uses the standard authorization-code flow; we never see your Google password.
Uploads
Images are checked by content (PNG, JPEG, WebP only), capped in size, stored content-addressed and served at unguessable addresses.
Backups and monitoring
Daily database and asset backups kept 14 days; unhandled errors are captured and the team is alerted on first occurrence.
Reporting a vulnerability
Use the contact page. We acknowledge within two working days and will not pursue good-faith researchers.
Other documents: Privacy policy · Terms of service · Data processing addendum · Cookie policy