Security
How the product is built to keep one customer's data away from another's.
This describes how the software behaves today. It has not been reviewed by a lawyer and is not a binding policy yet. Have it reviewed before you take a paying customer.
Separation between workspaces
Every record belongs to exactly one workspace, and every query is scoped to it in the application layer.
The PostgreSQL schema adds row-level security underneath that, so a query that forgets its filter returns nothing rather than another customer's data. The database role the application connects as cannot bypass those policies.
Credentials
Passwords are hashed with bcrypt. Access tokens for connected accounts, and two-factor secrets, are encrypted at rest.
Password reset and email verification links are stored only as hashes, work once, and expire.
Platform administrators must enrol a second factor before the admin console will open.
Abuse protection
Sign-in is rate limited per account and per address, so one is not a way around the other.
Payment webhooks are verified by signature against the raw request body, and each event is applied once.
Reporting something
If you find a security problem, write to hello@example.com. Please give us a reasonable window to fix it before publishing.