Security practices
The controls that protect customer data day to day. This describes what is implemented today, not aspirations.
Encryption
- In transit: all traffic is served over TLS, with HSTS enabled so browsers refuse downgraded connections.
- At rest: data is stored on encrypted volumes at our hosting provider.
- Application-layer: the most sensitive secrets, such as SSO/OAuth credentials and alert-channel webhook URLs, are additionally encrypted with AES-256-GCM using a key held separately from the application database, so a database copy alone does not expose them.
Access control
- Role-based access within each organization (Viewer, Analyst, Manager, Admin, Owner), so members only see and change what their role permits.
- Sessions use httpOnly, Secure, SameSite cookies; refresh tokens are host-scoped, and state-changing requests are CSRF-protected.
Application hardening
- A strict Content-Security-Policy with per-request nonces, plus the standard security headers (X-Content-Type-Options, Referrer-Policy, and others).
- Server-side request forgery (SSRF) protection on every outbound fetch: our crawler and integrations validate target URLs and refuse private, loopback, and cloud-metadata IP ranges.
- Input validation on all API endpoints and rate limiting on authentication routes.
Auditability & data lifecycle
- State-changing actions are recorded in an audit log attributed to the acting user.
- Right to erasure is implemented as account deletion that removes the user's personal data, and high-volume data is pruned on time-bound retention windows.
Incident response
Suspected incidents and vulnerabilities go to [email protected]; see our vulnerability-disclosure page for the reporting workflow, PGP key, and response-time targets.