Multi-tenant isolation, encrypted everything, every action logged. Built to OWASP from day one — not retrofitted.
Cost factor 12. Plain-text passwords never touch disk; rainbow tables are mathematically useless. Recommended by OWASP since 2009.
Raw tokens never persist server-side. Even if our database is compromised, attackers cannot impersonate users with the stolen data.
Session tokens unreachable to JavaScript. Immune to XSS theft. SameSite=Strict eliminates CSRF cross-site abuse entirely.
Every database query is filtered by tenant_id from the authenticated session. Cross-tenant data leakage is impossible by design — not by policy.
Every signup, login, edit, delete, AI query stored with IP and user-agent. SOC-2-ready evidence trail. Available for compliance reviews.
5 failed attempts per IP per 15-minute window. Brute-force attacks return 429 within seconds. Account-lock + IP throttle in layered defense.
12+ characters, mixed case, number, special character. Blocklist of common passwords. No weak-password attack surface, ever.
X-Frame-Options DENY · X-Content-Type-Options nosniff · Referrer-Policy strict-origin-when-cross-origin · CSP-ready.
Privacy policy + ToS shipped. Data export, deletion, and consent built into workspace settings. International data subject rights honored.
All 10 categories addressed from day one. Annual re-review.
Privacy policy, data export, consent, deletion all in place.
Audit in progress with a Big-4 affiliate. Reports available to Enterprise customers under NDA.
Continuous monitoring controls. 12-month observation window starts after Type I.
Available on enterprise self-host. Roadmap depends on customer demand.
SIG, CAIQ, and custom questionnaires already prepared. We sign your standard NDA and turn around responses in 48 hours.
Stripe (payments), Postmark (email), Cloudflare (DNS/CDN), Fly.io (hosting), Anthropic (AI). Updated when changed.
Found something? We pay for valid reports. Coordinated 90-day disclosure, no legal threats for good-faith research.
Vendor questionnaire, architecture review, pen-test results — whatever your team needs to greenlight us.
Request a security review →