Security
Security you can check, not just read about
Below is what we actually do today. We would rather list fewer things that are true than many that are not.
Account security
- Two-factor sign-in with authenticator apps (TOTP), available to every account.
- API keys are shown once and stored only as SHA-256 hashes. We cannot read them back.
- Sub-accounts for teammates so nobody has to share a login.
- A client-visible activity trail of sign-ins and account changes.
Data in transit and payments
- HTTPS everywhere, with HSTS enabled on the site.
- Card numbers are handled by our payment processors and are not stored on our servers.
- Browser hardening headers on every page: nosniff, frame protection, strict referrer policy and a restrictive permissions policy.
- A Content-Security-Policy is deployed in report-only mode while we tune it. It is not yet enforced.
Infrastructure resilience
- The website runs on three web nodes. If one fails, traffic moves to the others.
- The database is a three-node Patroni cluster with automatic leader failover.
- A global edge layer in eight locations terminates TLS and caches public content, with health-checked DNS steering visitors to a working edge.
- Edge servers run a default-deny firewall that opens only the ports they serve.
- Public service health is published on the status page.
What we do not claim
We do not currently hold SOC 2 or ISO 27001 certification. If your procurement process needs one, tell us before you buy. Our uptime commitment is the 99.9% target in the SLA, with service credits if we miss it.
Report a vulnerability
Email [email protected] with the subject “Security report”. Include the affected URL and steps to reproduce. Please give us reasonable time to fix an issue before disclosing it, and do not access other customers’ data. We will acknowledge reports and keep you updated. Our machine-readable contact is at /.well-known/security.txt.