Security architecture

Account protection

• •Passwords hashed with scrypt (memory-hard); never stored in plain text
• •Server-side sessions with hashed opaque tokens, secure cookies, expiry
• •Email verification, single-use expiring password-reset tokens
• •Rate limiting and lockouts on login, signup and reset endpoints

Tenant isolation

Every record carries its business identifier and all data access is scoped server-side by membership. Cross-business access attempts are denied and audited — verified by automated tests.

Document security

• •Private object storage; no permanent public URLs
• •Signed, short-lived download authorisation
• •Upload validation: extension, MIME type, size and content signature
• •Malware-scanning hook prepared; access logging enabled

Platform hardening

• •Strict Content-Security-Policy, HSTS, frame protection, nosniff
• •Webhook signature verification for payment events
• •Full audit log of security-relevant actions
• •Least-privilege roles: Owner, Admin, Manager, Member, Viewer

Honest limitations

We don't claim certifications we don't hold (no ISO, SOC 2 or GDPR-certification claims). Independent audits are the only way to verify such claims, and none have been performed yet.