Enterprise Security

Your data security matters to us. Here's a plain, verified account of the security measures and data protection practices we actually have in place today.

Our Security Practices Security Documentation

Security-First Architecture

Built from the ground up with enterprise-grade security and privacy controls

Data Encryption

Encryption in transit and at rest, verified against our live production environment.

  • • TLS 1.3 (TLS 1.2 fallback) for all traffic — plain HTTP is redirected to HTTPS
  • • Database encrypted at rest (AWS RDS, AES-256)
  • • Passwords are hashed with bcrypt, never stored in plain text

Access Controls

Role-based permissions and session controls govern who can do what.

  • • Role-based workspace permissions
  • • Signed session tokens (7-day expiry)
  • • Changing your password immediately revokes all other active sessions

Infrastructure Security

Hosted on AWS with a database that isn't reachable from the public internet.

  • • Hosted on AWS (EC2 + managed RDS)
  • • Database is network-isolated — only our application servers can reach it
  • • HTTPS enforced; plain HTTP requests are redirected

Compliance Status

We'd rather tell you plainly where we stand than put up a badge we can't back up.

  • • We do not hold SOC 2, ISO 27001, or HIPAA certifications at this time
  • • No third-party security audit has been completed to date
  • • Happy to answer specific security questions — see below

Data Privacy

Your data is yours — we don't sell it, and you can ask us to remove it.

  • • We do not sell your data to third parties
  • • Account and data deletion available on request

Incident Response

We're a small, hands-on team — here's what that means today, and what's ahead.

  • • Confirmed security incidents are communicated directly to affected customers
  • • Formal 24/7 monitoring and a written incident response plan: planned, not yet in place

Security Best Practices

How we protect your data throughout its lifecycle

Data Collection & Processing

We collect only the minimum data necessary for service functionality and apply strict processing controls throughout the data lifecycle.

  • Minimal data collection principle
  • Account and data deletion available on request

Data Protection

Your data lives behind authenticated APIs in a database that isn't reachable from the public internet

Secure Storage

Encrypted database, isolated from the public internet, with automated backups

Secure Data Storage

Your data is stored in an encrypted, network-isolated database with automated daily backups.

  • AES-256 encryption at rest (AWS RDS)
  • Automated backups, 7-day retention

Questions About Security?

We're happy to answer specific security questions directly — just ask.

Security Support