Security & Disclosure
Last updated 28 October 2026
How we protect the platform
- TLS everywhere, HSTS, strict security headers.
- Argon2id password hashing, two-factor authentication, mandatory two-factor and step-up confirmation for staff.
- Secrets and two-factor seeds encrypted with keys kept outside the database; integration keys are write-only.
- Role-based access, deny-by-default authorization and per-organization isolation.
- Rate limiting, automatic lockouts, honeypots and IP blocking against automated attacks.
- Immutable audit log of security, administrative and financial actions.
- Encrypted, verified backups stored apart from production credentials.
Responsible disclosure
Found a vulnerability? Email [email protected] with steps to reproduce. Please:
- only test against your own account and data;
- don't access, modify or delete other customers' data;
- don't run denial-of-service, spam or social-engineering tests;
- give us reasonable time to fix before disclosing.
We acknowledge reports within 2 business days, keep you updated, and won't pursue legal action against good-faith research that follows these rules.
Incidents
If an incident affects your data we notify you without undue delay with what happened, what data was involved and what we're doing about it.
Effective 28 October 2026.