Security

Passwords are hashed with argon2, never stored in plain text. Sessions use short-lived access tokens with revocable refresh tokens. Enterprise accounts can enable SSO via any OIDC-compliant identity provider.

Every administrative action is recorded in an audit log. Outbound webhooks are signed with HMAC-SHA256 so recipients can verify a delivery genuinely came from us.

This page describes real, currently-shipped practices. It does not claim any third-party security certification (e.g. SOC 2, ISO 27001) — if you pursue one, this page should be updated to reflect it, not before.