Security policy

What we do

• Tenant isolation is a forced row-level security policy in PostgreSQL, on a database role that is neither the owner nor a superuser.
• Every API route carries a permission key or an explicit public marker, and a coverage check fails the build otherwise.
• Passwords are hashed with Argon2id, with lockout. Sessions rotate, and revoking one revokes its family.
• Every mutation is written to a hash-chained audit log with a field-level diff.
• Secrets fail fast in production: the environment schema throws on defaults and placeholders.

What we do not have yet

• A SOC 2 certificate. The policy set exists and the audit log produces the evidence; the audit has not happened.
• A published penetration-test report.
• SAML, OIDC or SCIM.
• A formal uptime SLA, because we have no telemetry to hold ourselves to one yet.

What we ask

If you find something, tell us before you tell anybody else. We will acknowledge within two working days, keep you updated, fix it, and credit you if you want to be credited. We will not threaten you.