Security at AlignLane

Every workspace, relationship, board and task table is protected by Postgres row-level security. Authorization is enforced in the database, not only in the interface.

Public boards, private links and the partner view read a snapshot built from shared tasks and an allow-list of shared fields. Internal notes and estimates are stored in a separate host-only table and never enter the snapshot.

Private links use 128 bits of random token material. Only a SHA-256 digest is stored, so a database row cannot reconstruct a link. Links can be rotated, revoked or given an expiry.

Email sign-in links expire after 15 minutes, work once, and are stored hashed. Sessions are revocable server-side.

Boards start private. Publishing is an explicit owner action; a published board is indexable by default on a stable tokenless URL, and owners can switch search visibility off (noindex,nofollow, removed from sitemaps) or unpublish (URL returns 404, caches purged). Every change is audit-logged. Private token links are never indexed or placed in canonical tags, and are served with Referrer-Policy: no-referrer.

Sign-in, share-token, import and AI endpoints are rate-limited.

HTTPS everywhere with HSTS; strict security headers and a content security policy.

Uploaded export files are parsed and discarded. Only the mapped fields you choose are stored; excluded columns are dropped.