Security and privacy

What the product does today to protect your organization's data — no promises beyond what exists.

• Isolation between organizations

  Every query is filtered by organization and the server rejects queries without that filter; an automated isolation test covers it.

• Tamper-evident audit trail

  Logins, changes and views are written to append-only records, hash-chained, with integrity verification.

• Access and sessions

  bcrypt passwords, attempt limits, session revocation on password change, single sign-on (OIDC, SAML, LDAP) and SCIM provisioning.

• Files

  Real file-type validation, optional antivirus (ClamAV), downloads under a restrictive security policy and a SHA-256 hash of each revision.

• Browser and network

  HTTPS, nonce-based Content-Security-Policy, security headers and protection against requests to internal addresses in integrations.

• Tokens and secrets

  API tokens, public links and invitations are stored only as hashes; integration secrets are encrypted.

• Backup and monitoring

  Daily backup of the database and files with verification and 14-day retention; health check every 5 minutes with operations alerts.