Security

Every tenant-scoped table is protected by row-level security, so a query that forgets its scope still cannot return another organization’s rows. We test this deliberately, by issuing unscoped queries against seeded data and asserting the database refuses them.

Tokens and API keys are encrypted at rest with envelope encryption. Secrets are never logged, at any level, and are masked in the interface once saved.

All traffic is HTTPS, with HSTS. Content Security Policy headers restrict which scripts can run, which matters most on published sites where third-party tracking may be present.

The staff console sits on its own hostname behind an identity gate, and the application independently verifies that gate rather than trusting it. Multi-factor authentication is required for the roles that can change content or configuration.

Staff have no standing access to your site content. Where hands-on help requires it, access is granted only with your explicit consent, scoped to one site, time-boxed, and recorded in an audit log you can read.

If you believe you have found a security issue, contact us before disclosing it publicly. We will confirm receipt and keep you updated while we investigate.