Security

What we do, stated plainly. We do not offer end-to-end encryption, and we won't claim to.

Encryption in transit and at rest

TLS for every connection. Data and files are encrypted at rest by our hosting provider.

Every table checks who you are and which workspace you belong to, in the database itself.

API keys and invite tokens are stored only as SHA-256 hashes and shown once.

Attachments live in a private bucket and open through short-lived signed links.

Agents can't write consent, approve drafts or change policies.

Policy decisions, admin actions and support views are recorded in an append-only log.