Security

All traffic uses TLS. Passwords are stored only as Argon2id hashes. Connected-account tokens, provider keys and two-factor secrets are encrypted with AES-256-GCM before they are stored. Database backups are encrypted with AES-256-GCM, and each backup key is wrapped with ML-KEM-1024 (Kyber, NIST FIPS 203), a post-quantum key encapsulation standard.

Password hashing uses Argon2id with per-secret salts. Refresh tokens are stored as SHA-256 digests and rotated on every use.

Authentication supports email and password, time-based one-time-password (TOTP) two-factor authentication, and WebAuthn passkeys (Touch ID, Face ID, Windows Hello or a hardware security key). Add a passkey under Settings, Security, then choose Sign in with passkey on the sign-in page.

The permission scheme is role-based with five built-in roles (owner, admin, manager, user, viewer) and per-permission scoping on a per-module basis. Custom role-permission overrides are available to platform admins.

By default, all workspaces share a control-plane Postgres with row-level isolation enforced by an organization_id column on every tenant-owned table plus a runtime guard.

Enterprise customers can request a per-tenant dedicated Postgres database, the application transparently routes queries to the dedicated DB based on the tenant identifier.

Every administrative action (user creation, role change, plan change, addon toggle, sensitive-data access, document share, etc.) is recorded in an immutable audit log with actor, IP, request ID, and a JSON diff of before/after state.

Audit log retention defaults to 90 days; Enterprise customers can extend to 7 years. Exports are available as JSON or CSV from Settings then Audit log.

Customers using the Document Vault module can configure retention policies per folder. Policies can be required-retention-years (block delete before X years) and legal-hold (block delete regardless).

Classification rules auto-label documents at ingestion based on regex or content-classifier pattern matches (for example, SSN-shaped strings then "confidential").

Send vulnerability reports to [email protected]. We acknowledge within 24 hours, triage within 72 hours, and aim to remediate critical issues within 7 days of confirmation.

We do not currently run a paid bug-bounty program; significant findings are publicly credited (with your permission) in the post-mortem.