Security

Tenant isolation, enforced by the database

Every tenant table carries an org_id and a PostgreSQL row-level-security policy, with RLS FORCED so even privileged application paths cannot skip it. Application queries run inside a transaction whose org context is set per-transaction; without it, queries fail closed to zero rows.

A conformance test suite sweeps every tenant table on every run and proves one org cannot read another's rows. New tables are covered automatically — a table without a policy fails the build.

Least-privilege by construction

Three separate database roles: the app role is RLS-enforced and owns no schema; the auth role can reach identity tables only; the owner role (migrations, billing webhooks) is import-restricted in the codebase and never serves user requests.

Server-side permission checks (owner / admin / member) gate every administrative action, and the same checks gate what the AI assistant's tools may do — it executes through the identical permission layer as the UI.

Account security

Passwords are handled by Better Auth with modern hashing; TOTP two-factor authentication and passkeys are built in. Sessions are server-side and revocable — offboarding a member removes their access everywhere in one step.

Encryption

All traffic is TLS in transit. Every response carries hardened headers: X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy and a locked-down Permissions-Policy. Encrypted volumes at the hosting layer are a launch requirement in our deployment runbook — we will not go live without them.

Your data stays yours

Owners and admins can export the entire workspace at any time from Settings → Export: one zip of JSON, CSV and Markdown — open formats that need no importer. Direct messages, personal to-dos and private AI conversations are excluded by design; they belong to people, not the company.

Every state change in the product lands on one append-only activity stream, visible under Settings → Activity. Plans with audit export include the full event history in the data export.

AI with boundaries

Ground Control, the built-in AI admin, reads and writes only through the same permission-scoped module APIs as the interface — row-level security bounds what any prompt can reach. Conversations are private to each person, usage is metered per organization, and external model calls are disabled unless the operator configures a provider key.

Backups & continuity

The backup runbook (docs/05) defines a database dump every 6 hours, 14-day retention, a restore drill, and a backup before each migration. Off-box storage is part of that runbook and waits on an approved bucket. Exports give every customer an additional off-platform copy on demand.

Subprocessors

We keep the list short and each provider is active only when its feature is enabled: Stripe (billing), Resend (transactional email), Anthropic (AI assistant), Google (Workspace resale, pending). The current list with data categories lives in our subprocessor register (docs/legal/subprocessors.md) and changes are announced in advance.

Responsible disclosure

Found something? Write to the founders — the security contact address is published on this page once the production domain is live — and we will acknowledge within 48 hours. We don't pursue good-faith researchers.