Security

Sign-in

There are no passwords in the service, so there is nothing to guess, reuse or phish. A personal account is held by a credential created on your own device, which is bound to this site and cannot be replayed against another. A corporate account is authenticated by the organisation’s own sign-in system, which keeps control — including multi-factor policy and revocation — where it belongs.

Sessions are held in a cookie restricted to this site, unavailable to scripts, and not sent with requests originating elsewhere.

Separation

Each organisation’s data is separated from every other’s, and an account belongs to exactly one organisation for its whole life, so no account can bridge two. The boundary is enforced on every request against the account record rather than the session, so withdrawing someone’s access takes effect immediately.

Data protection in transit and at rest

All traffic is encrypted in transit and refuses to fall back to an unencrypted connection. Stored data is encrypted at rest by our infrastructure provider. Exports are signed so that a file’s integrity can be checked before it is trusted.

Building and deploying

• Every change is reviewed, and cannot reach production until the full automated check suite passes.
• Dependencies are pinned to exact versions and updated through reviewed proposals; the codebase is deliberately kept to almost none.
• Every change is scanned for committed secrets, and a finding blocks the build.
• Each proposed change is deployed to its own isolated environment with its own data, never sharing production’s.
• A bad release can be rolled back in under a minute, and changes are built to be compatible with the previous version’s data so that rolling back is always safe.

Access and monitoring

Access to production is limited to those who need it, granted through the infrastructure provider’s own controls, and recorded. Credentials are held as managed secrets, never in the codebase. Operational and security events are logged and retained for a limited period.

Browser hardening

Pages are served with a content security policy that permits no inline or third-party scripts, refuses to be framed, and sends no referrer to other sites. There are no third-party scripts, trackers or advertising components anywhere in the service.

Resilience

The service runs across a global network with no single machine to lose. Data can be exported at any time, and an organisation’s administrators can take a complete copy of its content whenever they wish — the most reliable backup being one you hold yourself.

Reporting a problem

Please tell us: see the Vulnerability Disclosure Policy.