Security
What we do today. We do not hold ISO 27001 or SOC 2 certification and do not claim to.
Tenant isolation
Every tenant row carries an organisation id, and PostgreSQL Row Level Security is enforced on top of application checks. Isolation is covered by automated tests.
Authentication
Email verification is required, passwords are hashed with a modern algorithm, sessions are HTTP-only secure cookies, and login endpoints are rate-limited.
Documents
Uploaded files are validated by type and size, stored privately, and served only to authenticated members of the owning organisation. There are no public links.
Encryption
TLS in transit everywhere. Database encryption at rest is provided by the managed database provider.
Audit logging
Sign-ins, uploads, verdict overrides and admin actions are recorded with time and actor.
Data deletion
Organisation owners can request deletion of their workspace; we delete within 30 days and confirm by email.
Responsible disclosure
Report vulnerabilities through the contact form. We acknowledge within 3 working days.