Security
What we actually do, stated plainly. This page is part of our Article 28 documentation and is updated as the service evolves.
Architecture & jurisdiction
- Single-tenant-per-workspace data model on infrastructure operated by Vassbrekke AS in Norway/EEA.
- No third-party analytics SDKs or telemetry in the product.
- Minimal processor footprint (see Sub-processors).
Authentication & sessions
- Passwords hashed with scrypt and per-user random salts, compared in constant time.
- Session tokens are 256-bit random values; only their SHA-256 hash is stored server-side.
- Cookies are httpOnly, SameSite=Lax, Secure in production; expiry enforced server-side.
- Password reset tokens are single-use, hashed at rest, expire in 1 hour, and revoke all existing sessions on use.
- Login, registration, and reset flows are rate-limited per IP; timing-equalized responses prevent account enumeration.
Authorization
- Every API route requires an authenticated session or admin role except health, auth, webhooks, and OAuth callbacks (each with its own verification).
- All data operations are scoped to the caller's workspace — cross-workspace access returns not-found.
- Role-based access: admin vs viewer, enforced server-side on every mutation.
Data protection
- TLS enforced in transit; HSTS with preload.
- All SQL uses prepared statements — no interpolated queries anywhere in the codebase.
- No raw HTML injection sinks; React escaping throughout.
- Stripe webhook signatures verified with HMAC-SHA256, timestamp tolerance, and constant-time comparison; unsigned webhooks refused in production.
- OAuth uses state-cookie validation and PKCE.
Operations
- Dependency auditing with zero known vulnerabilities at release; framework patches applied promptly.
- Security headers: nosniff, frame-deny, strict referrer policy, restrictive permissions policy, HSTS preload. Server fingerprint header disabled.
- Demo/dev backdoors disabled by default in production and gated by environment flags.
Independent review
A full code-level security audit was completed on 2026-08-23 covering dependencies, secrets handling, authentication, authorization (cross-tenant isolation), injection surfaces, payment webhook integrity, OAuth flows, and transport hardening. Three findings were identified and fixed during the audit; the report is available on request to customers and prospects.
We do not hold SOC 2 or ISO 27001 certifications and say so plainly. If your procurement requires them, ask us about roadmap status.
Report a vulnerability
Found something? Contact details are published in /.well-known/security.txt — we take every report seriously and respond quickly.
Related: Trust & jurisdiction · DPA · Sub-processors