Security

Today

• The website is static and served over HTTPS by Vercel.
• There are no user accounts, no server-side database and no customer data.
• The Studio demo stores data only in your browser. Its roles are a demonstration and do not enforce access control.
• No API keys or secrets are included in the site’s code.

Planned for customer workspaces

• Secure sign-in with session expiry, password reset and invitations, then SSO and MFA.
• Each organization in its own workspace, with every request and database query checked against the signed-in user’s membership and role on the server.
• Database-level isolation policies so one organization’s data cannot be read by another, tested explicitly.
• Audit records for administrative and data-changing actions.

We do not hold security certifications today and will not claim any until they are earned.

Report a vulnerability

If you believe you have found a security issue, tell us through the contact form and start your message with “Security report”. Please give us reasonable time to fix it before disclosing it publicly, and do not access or modify data that is not yours.