✓Tenant isolation enforced by the database. Every row of every table is tagged with an organization id. The database refuses to return rows from other organizations even if our application code had a bug — the check happens before the data leaves the database.
✓Passwords stored as bcrypt hashes. Even if our database were exfiltrated, passwords would not be readable.
✓HTTPS only. All traffic between your browser, our servers, and our database providers is encrypted in transit (TLS 1.2+).
✓Cookies are httpOnly and SameSite-Lax. Session tokens cannot be read by JavaScript running in your browser — XSS cannot steal them.
✓Two-factor authentication available. Any user can enable TOTP (Google Authenticator, Authy, 1Password) from their account settings. Required to sign in once enabled.
✓Rate limiting on sensitive endpoints. Login attempts, password changes, invitations and MFA verifications are rate-limited to mitigate brute-force and credential stuffing.
✓Strong password requirements. Minimum 10 characters, mixed case, with a digit. New passwords are checked against the HaveIBeenPwned database of leaked credentials — known-breached passwords are rejected. ✓Audit log of sensitive actions.Every member change, team change, project change, plan change, password/email/MFA modification is recorded with timestamp, actor and (when relevant) target. Organization admins can review their own org’s log.
✓Forced sign-out on credential changes. Changing your password, email, or MFA settings signs out all other devices automatically. You can also do it manually from your account settings.
✓Modern security headers. Strict CSP, HSTS, X-Frame-Options DENY, Referrer-Policy minimum, Permissions-Policy restricted to defaults.
✓Soft delete with 30-day grace. Deleting an organization moves it to a recoverable state for 30 days before permanent purge. Mistakes are recoverable.
