Security
What we protect, written so you can check it.
Each line on this page describes something this codebase actually does. What we do not do yet is not written here.
Certification
ISO 27001 certified information security management
We hold the certification for our information security management system. The rest of this page rests on the code, not on an external audit.
Workspace isolation
- Checked on every requestEach read and write first confirms that the caller is a member of that workspace. The check runs in the application, on every request.
- One workspace never reads anotherAn account can belong to several workspaces, but a session only ever sees data from the one it has open.
- Deleting a workspace is immediateA workspace is removed at once, with no waiting period. Account deletion works differently.
Encryption
- In transitTraffic moves over HTTPS only. HSTS is set to two years, so a browser will not fall back to plain HTTP.
- Stored secretsThe SMTP password and the two-factor secret are stored encrypted with AES-256-GCM. Those two fields are what this application encrypts itself.
- Account passwordsPasswords are kept only in a form that cannot be reversed: bcrypt at cost 12. The original is never stored.
Access control
- Roles narrow what a member can doOwner, admin, editor, and viewer, with a job seat capping each member on top. A seat can only narrow access, never widen it.
- Two-factor sign-inTurn on TOTP from an authenticator app and ten backup codes come with it. Each backup code works once.
- Sign-in attempts are cappedTen attempts per IP address and five per account in any fifteen minutes.
- Sessions last 24 hoursA signed-in session ends after 24 hours. A change to a role or a policy reaches open sessions within about five minutes.
What gets recorded
- Audit trailActions that are hard to undo, adding or removing a member, changing a role, deleting, record who did it and when.
- Newsroom readsWho opened your newsroom and what they read is visible to that workspace only. It never crosses to another customer.
- Crisis Q&A drafts stay insideThe AI crisis Q&A draft has no external sharing feature. The capability was never built.
The data belongs to whoever put it in
- Take it out wheneverRequest a download of your data from account settings, once every 24 hours.
- Account deletion waits 30 daysAsk to delete and it is scheduled 30 days out. You can undo it in the meantime.
- Trash keeps 30 daysDeleted items sit in the trash for 30 days before they are cleared.
If you find a vulnerability, tell us. We confirm it, write back, and record the fix in the release notes.