Security
Updated
Controls in place
- Row-level security on every workspace and relationship table — authorization is enforced in the database, not only in the interface.
- Shared snapshots are generated at publish time from shared tasks and shared fields only.
- Private link tokens are 128-bit random values; only a SHA-256 hash is stored.
- Sign-in links are single-use, expire after 15 minutes and are stored hashed.
- Rate limits on sign-in, share-token, import and AI endpoints.
- HTTPS everywhere with HSTS.
Not yet available
SSO/SCIM (Roadmap), security audit log (Coming soon), custom domains (Coming soon). We do not claim SOC 2 or other certifications.
Next: Data retention →