Small attack surface. Provable controls. No theater.
Security pages usually list badges. Ours lists controls — mapped to the NIST Cybersecurity Framework and verifiable in the product's behavior.
Mapped to NIST CSF 2.0
Govern
Security ownership sits with the founding team, not a future hire. Policies cover access control, vendor review, data classification, and incident response — reviewed on a fixed cadence and versioned like code.
Identify
A maintained asset and data inventory: what we store, where it lives, which subprocessor touches it, and its retention clock. Minimal-PII design keeps the personal data we hold small, and integration credentials are encrypted at the application layer.
Protect
Tenant isolation enforced with database row-level security on every table and proven by automated cross-tenant tests in CI. TLS 1.2+ in transit, encryption at rest, managed authentication (password, magic-link, and Google sign-in) with passwords stored only as salted hashes by our auth provider, least-privilege service keys that never reach a browser, and OWASP-aligned application controls.
Detect
Structured audit logging on sensitive operations, anomaly alerts on authentication and spend, and dependency/vulnerability scanning in the build pipeline — failures block deploys.
Respond
A written incident-response runbook with severity tiers, customer-notification commitments, and a responsible-disclosure channel published at /.well-known/security.txt. Reports are acknowledged within 72 hours.
Recover
Automated daily backups with defined RPO/RTO targets, restore drills, and single-region blast-radius containment. Post-incident reviews are blameless and produce tracked fixes.
OWASP Top 10, addressed by design
- Injection & XSS
- Framework-level output encoding everywhere; a single audited structured-data exception with hard escaping; parameterized queries and schema validation (zod) on every input boundary.
- Broken access control
- Row-level security as the floor, not middleware promises — every table policy is exercised by automated cross-tenant tests.
- Authentication failures
- Password, magic-link, and Google sign-in through a managed auth provider, with passwords stored only as salted hashes by that provider; workspace- and brand-selection cookies are httpOnly, secure, and same-site — the primary session cookie is same-site protected, with httpOnly deliberately off so the client library can read it.
- Security misconfiguration
- Strict security headers (CSP, HSTS, frame-ancestors none, nosniff, referrer policy), locked-down CORS, and configuration reviewed in code, not consoles.
- Vulnerable components
- Pinned dependencies, automated advisories, and a bias for the platform over the package — fewer dependencies, less surface.
- SSRF & supply chain
- Outbound fetches allow-listed and guarded against SSRF; this site loads Google Analytics and Google Tag Manager.
What we hold, and what we refuse to.
- What we hold includes your sign-in email and the name, email and answers you submit on our forms. In our database, the IP address recorded with a form submission is stored as a hash, salted with a secret and the UTC date. API rate limiting keeps counters keyed by the requester's IP address.
- Your workspace data never trains AI models, ours or anyone's
- Measurement through official interfaces — your reports carry no scraping liability
- Export everything, anytime; deletion within 30 days of a verified request
- Audit trail on sensitive operations, retained for accountability
Found something? Tell us.
We operate a responsible-disclosure program. Report vulnerabilities to [email protected] — machine-readable details live at /.well-known/security.txt. We acknowledge within 72 hours, keep you informed through remediation, and credit researchers who wish to be named. Good-faith research within the program scope will never result in legal action from us.
Compliance roadmap: our controls are built and documented against SOC 2 criteria from day one; formal Type I attestation is scheduled with revenue milestones, and we'll publish it here the day it lands — not a week before the sales call needs it.
Bring your security questionnaire. We like those.
Self-serve. Transparent pricing. No sales call required.