Security is foundational to a credibility platform. This page summarizes our controls. Pilot prospects can request a deeper security review via our contact form.
Authentication & access
- OpenID Connect via Replit Auth — no passwords stored by us.
- Server-side sessions with rotating secret; instant revocation supported.
- Email allowlist gates access during the pilot program.
- Role-based access control: viewer / leader / admin / super-admin, enforced server-side on every request.
Data isolation
Multi-tenant data is partitioned by orgId. Every per-org query is scoped to both the route’sorgId and the caller’s verified org membership. There is no “global” read path.
Encryption
- TLS 1.2+ for all traffic in transit.
- Integration credentials (Jira, Monday, Slack) encrypted at rest with AES-256-GCM via a versioned envelope.
- PostgreSQL storage at rest is encrypted by our hosting provider.
Audit logging
Sensitive actions (project deletion, role changes, financial edits, demo seeding, pilot approvals/declines, and first-of-session reads of financials and integration credentials) are written to an append-only audit log with actor, timestamp, target, and metadata.
Operational hardening
- Rate limiting on write mutations, external integration calls, and unauthenticated public endpoints.
- SSRF guard on user-supplied URLs (Jira site URL).
- Structured error handling — no stack traces in production responses.
- Server-side input validation on every write via Zod.
Vulnerability management
- Dependency audit on every release; high and critical advisories patched before deploy.
- Static application security testing (SAST) and privacy/dataflow scanning as part of the build.
- Production runs on the current patched line of every direct and transitive dependency.
- Responsible disclosure: use our contact form with subject "Security report"; we acknowledge within 2 business days and aim to remediate critical issues within 7 days.
Backups & recovery
- RPO: 24 hours (rolling daily backups for 7 days).
- RTO: 4 hours from the decision to restore.
- Restore procedure documented internally and tested quarterly.
Incident response
We notify affected customers in writing within 72 hours of confirming a personal-data breach, including what we know, what we’re doing, and what you can do.
Subprocessors
See our live list. We will give 30 days’ notice before adding a new subprocessor that processes Customer Data.