Security
What we do, described plainly enough to be checked.
In transit
- Every domain is served over TLS, behind Cloudflare, with HSTS set.
- Browsers are sent a content security policy that limits where a successful injection could send anything it stole.
- Public endpoints that can be used to guess passwords or burn credit are rate limited by the caller's real address, taken from the edge rather than from a header a caller can write.
At rest
- Passwords are stored as hashes, never as passwords.
- Tokens that let us reach a connected account — a calendar, for instance — are encrypted with AES-256-GCM before they are written, and the code has no path that stores them any other way.
- Card numbers and CVVs never reach our servers. Payments go through licensed gateways, and what comes back is an identifier, not a card.
- Every query that reads tenant data is bound to the account in the caller's token, not to an identifier supplied in the request.
Messages from platforms
Webhooks that arrive from WhatsApp and payment providers are verified against their signature over the exact bytes received, before anything in them is read. An unsigned or altered delivery is refused rather than trusted, which is what stops a stranger from writing into a business's conversation history.
What connected accounts can see
We ask a connected account for the narrowest access that does the job. A connected calendar, for example, grants free/busy and the events our assistant creates — not the contents of your meetings, and not your mail. Access can be revoked from your side or ours at any time, and revoking it stops the feature rather than degrading it silently.
Reporting a vulnerability
If you have found something, write to [email protected] with enough detail to reproduce it. We will confirm we received it, and we will not pursue anyone who reports in good faith and does not access or alter other people's data while testing.
What we do not claim
We hold no third-party security certification, and we do not claim one. Nothing on this page is an audit; it is a description of how the systems are built, written so that it can be checked against them. If something here turns out not to match the code, tell us and we will correct the page.