Security overview
Sessions, scoped API keys, and operational safeguards.
Last updated 2026-09-01
What we protect
Application stores account credentials and Business operational data (parties, catalog, invoices, and more). For CRM/ops data tenants store, the Business account holder is the controller and the operator acts as processor. For account login data, the operator is the controller — see the Privacy Policy.
Authentication controls
- Email/password with verification and password reset flows
- httpOnly session cookie _i_s backed by Redis sessions
- Re-authentication for sensitive account actions
- Business Application secrets stored encrypted/hashed; rotate and revoke supported
- Rate limiting on auth and many Business routes
Tenancy & scopes
Data access is Business-scoped. Integration credentials cannot exceed granted scopes and cannot manage roles, Business settings, dashboards, or Applications themselves.
Infrastructure & processors
Known categories
- PostgreSQL host for primary data
- Redis for sessions and caches
- Backblaze B2 (S3-compatible) for object storage
- SMTP / Nodemailer for platform mail; optional Business outbound (Resend / Postmark / SMTP)
- Stripe for subscription payments
- Formspree for public contact forms
Formal SOC 2 / ISO attestations are not claimed in these docs unless published separately.
Constraints
- No OAuth/SSO
- No public tenant webhook catalog (Stripe billing webhook only)
- Report suspected account compromise via support