TLS everywhere, encrypted at rest, JWT + refresh, RBAC checked server-side. The unglamorous work that keeps your data yours.
Last updated June 1, 2026
Every byte between your browser and our servers travels over TLS 1.2+. We enable HSTS on all production domains so browsers refuse to downgrade.
At rest, the managed Postgres database and object storage are encrypted with AES-256 by our infrastructure provider. Backups are encrypted with the same keys and rotated automatically.
Sessions use signed JWT access tokens with short lifetimes plus rotating refresh tokens. Refresh-token rotation detects reuse — a stolen refresh token gets the whole family revoked on the next attempt.
Passwords are hashed with bcrypt (work factor tuned for current hardware) before they ever touch the database. We never log them, never email them, and they can't be retrieved — only reset.
Work-mode workspaces use a four-tier model: Employee → Manager → Finance → Admin. Permissions are checked on every API call and cached in Redis with explicit invalidation on role changes — so a demoted user loses access immediately, not on next login.
Approval flows and finance-only actions are gated server-side; the UI is decoration, not the boundary.
Every row that belongs to a workspace carries an indexed workspace_id. Queries are parameterised through a service layer that refuses to run without one — there's no path where a forgotten WHERE clause can spill another tenant's data.
Personal accounts get their own isolated workspace at signup. Switching modes never blends data.
AI Coach uses your own API key. Prompts stream from your browser to our backend to your chosen provider — we don't archive prompt bodies, and we don't fan out to a shared provider account.
Run a local Ollama instance and the entire round-trip stays inside your network. Bring-your-own keys mean bring-your-own privacy posture.
The app runs on a managed container platform with auto-rotated TLS certificates, automatic patching of the underlying OS, and isolated network segments for the database tier.
Production access is restricted to a short list of engineers, gated by SSO + hardware keys, and every shell session is logged.
Every approval, rejection, edit, and finance action is captured to an append-only audit log — no in-place edits, no silent rewrites. Workspace admins can export the trail any time as CSV or JSON.
Logs are retained for up to 7 years where required for financial-record compliance.
Found something? We want to know. Email [email protected] with the subject line "[security]" and we'll acknowledge within one business day.
What helps us most:
Please don't run automated scanners against production, don't exfiltrate data beyond proof-of-concept, and give us a reasonable window to fix before public disclosure. We won't pursue good-faith researchers who follow these guidelines.
Direct security questions: [email protected] · +977 9848767083.
For general support, the contact page is the easiest path.
Email [email protected] or visit the contact page.
