Security and data protection
What we do to protect your data and your customers' data, in plain terms.
How your data is handled
Ask us about any of these and we will explain exactly how it is done.
AI providers are disclosed
Before project data is sent to an AI provider, we document which provider is involved, what data it receives, and which account and retention settings apply.
Encrypted in transit and at rest
HTTPS is enforced on every request, and the database and its backups are encrypted at rest.
Sessions you can revoke
Admin sessions use signed tokens with passwords hashed using bcrypt. Every admin request is checked against the database, so revoking access takes effect immediately.
Rate limiting on public endpoints
Public endpoints are rate limited in the database rather than in memory, so the limit holds across restarts and instances. This blunts brute-force and scraping attempts.
No third-party trackers
No analytics scripts, advertising pixels, or session recorders. Nothing about your visit is sent to a third party for profiling.
Every input validated
Inbound requests are checked against a schema before anything touches the database, with payload size limits and request timeouts to keep a bad request from becoming an outage.
NDAs and security questionnaires
Send yours over and we will fill it in. Where the answer is no, we say so plainly.
Questions about your data?
Ask us on WhatsApp or email. We answer plainly.