Security is part of the product
Here's how we protect your business data. This page describes our current practices; it is not a certification.
- Tenant isolation
- Every record belongs to one workspace, and every server query is scoped to the signed-in workspace. Requests for another workspace's data behave as if the data doesn't exist.
- Encrypted credentials
- AI provider keys and webhook secrets are encrypted with AES-256-GCM and bound to their workspace. Keys are never shown again after saving and never sent to your browser.
- Accounts and sessions
- Passwords are hashed with scrypt. Sessions use secure, HTTP-only cookies, and repeated failed sign-ins lock the account temporarily. Password reset links expire after one hour and can be used once.
- File handling
- Only CSV and .xlsx files up to 2 MB are accepted. Files are parsed in memory and never executed; only the row values are kept. Exports neutralise spreadsheet formulas.
- AI safeguards
- AI output is treated as untrusted text. It is shown to you or attached to results, but never decides who receives a message, what amount is charged or which action runs. Inputs are length-limited.
- Outgoing connections
- Webhook destinations must be public HTTPS addresses; private and internal networks are blocked. Every delivery is signed so you can verify it came from us.
- Idempotent actions
- Reminders, notifications and payment events carry unique keys, so retries and duplicate deliveries never send twice or charge twice.
- Audit trail
- Sign-ins, configuration changes, key changes and administrator actions are recorded in an audit log.