Small attack surface. Provable controls. No theater.
Security pages usually list badges. Ours lists controls — mapped to the NIST Cybersecurity Framework and verifiable in the product's behavior. The most effective control we have is architectural: we collect almost nothing worth stealing.
Mapped to NIST CSF 2.0
Govern
Security ownership sits with the founding team, not a future hire. Policies cover access control, vendor review, data classification, and incident response — reviewed on a fixed cadence and versioned like code.
Identify
A maintained asset and data inventory: what we store, where it lives, which subprocessor touches it, and its retention clock. Minimal-PII design keeps the crown jewels small — you can't breach what was never collected.
Protect
Tenant isolation enforced with database row-level security on every table and proven by automated cross-tenant tests in CI. TLS 1.2+ in transit, encryption at rest, passwordless auth, least-privilege service keys that never reach a browser, and OWASP-aligned application controls.
Detect
Structured audit logging on sensitive operations, anomaly alerts on authentication and spend, and dependency/vulnerability scanning in the build pipeline — failures block deploys.
Respond
A written incident-response runbook with severity tiers, customer-notification commitments, and a responsible-disclosure channel published at /.well-known/security.txt. Reports are acknowledged within 72 hours.
Recover
Automated daily backups with defined RPO/RTO targets, restore drills, and single-region blast-radius containment. Post-incident reviews are blameless and produce tracked fixes.
OWASP Top 10, addressed by design
- Injection & XSS
- Framework-level output encoding everywhere; a single audited structured-data exception with hard escaping; parameterized queries and schema validation (zod) on every input boundary.
- Broken access control
- Row-level security as the floor, not middleware promises — every table policy is exercised by automated cross-tenant tests.
- Authentication failures
- Passwordless magic links and OAuth; no password database to breach; workspace- and brand-selection cookies are httpOnly, secure, and same-site — the primary session cookie is same-site protected, with httpOnly deliberately off so the client library can read it.
- Security misconfiguration
- Strict security headers (CSP, HSTS, frame-ancestors none, nosniff, referrer policy), locked-down CORS, and configuration reviewed in code, not consoles.
- Vulnerable components
- Pinned dependencies, automated advisories, and a bias for the platform over the package — fewer dependencies, less surface.
- SSRF & supply chain
- Outbound fetches allow-listed and guarded against SSRF; no third-party scripts, pixels, or CDNs on this site — nothing to poison.
What we hold, and what we refuse to.
- No PII beyond a login email — by design, not policy
- Your workspace data never trains AI models, ours or anyone's
- Measurement through official interfaces — your reports carry no scraping liability
- Export everything, anytime; deletion within 30 days of a verified request
- Audit trail on sensitive operations, retained for accountability
Found something? Tell us.
We operate a responsible-disclosure program. Report vulnerabilities to [email protected] — machine-readable details live at /.well-known/security.txt. We acknowledge within 72 hours, keep you informed through remediation, and credit researchers who wish to be named. Good-faith research within the program scope will never result in legal action from us.
Compliance roadmap: our controls are built and documented against SOC 2 criteria from day one; formal Type I attestation is scheduled with revenue milestones, and we'll publish it here the day it lands — not a week before the sales call needs it.
Bring your security questionnaire. We like those.
Self-serve. Transparent pricing. No sales call required.