Everything on this page describes controls that are actually running — no aspirations, no badges we don't hold. We name the vendors that touch your data in our privacy policy; we don't publish the rest of our infrastructure, which is itself a control.
Documents are stored encrypted at rest and served only through short-lived signed URLs scoped to the person viewing, which expire long before a link could be passed around. Deleting your account purges the stored files, not just the database rows.
Every shared link is gated by an email code, scoped to a session, and revocable — revoking a link kills its active sessions immediately. Viewer pages carry watermarks and are excluded from search engines. Every view is logged for you. The system never confirms who does or doesn't have access to anything (no enumeration, anywhere).
No passwords to steal: LinkedIn is the only way in. On a browser we don't recognise, sign-in also asks for a single-use code sent to your email, and no session exists until you enter it — so someone who gets at your LinkedIn account still doesn't get your room. Codes are single-use and short-lived, lock after repeated wrong guesses, and are throttled per address and per network, including an aggregate lockout that can't be reset by requesting fresh codes. Browsers you've approved are remembered for a limited time, and you can see and revoke them in Settings. Session tokens are stored hashed; the LinkedIn access token is used once and never stored.
Every stored connection credential is encrypted at rest under a deliberately slow key derivation, and access tokens are held only as long as they are valid — Stripe's are short-lived and rolled automatically. Disconnecting a service wipes every credential we hold for it. Sign-in is the one place we store nothing: the LinkedIn token is used once and discarded.
Signed webhooks with replay protection. Rate limiting keyed to real client addresses (proxy-chain calibrated against production, so spoofed headers don't bypass it). Strict security headers on every host. API documentation endpoints disabled in production. Error messages never leak internals — details go to logs, not responses.
Automated dependency vulnerability alerts on every repository, with prompt patching (most recently: framework-level CVEs cleared within days of disclosure). Migrations are tested up-and-down before deploy, staged on a separate environment with its own database before reaching production.
Document processing runs on commercial AI APIs — today Anthropic, and possibly OpenAI — under terms that prohibit training on your content. Prompts and outputs are scoped per workspace.
We don't yet hold SOC 2 or ISO certification — we're a small team and say so. If your diligence process requires a formal audit report, ask us and we'll show you the underlying controls directly.
We keep a full information security policy — governance, access reviews, subprocessors, patch commitments, incident response, retention — written control by control. We share it on request rather than publishing it, for the same reason we don't publish our infrastructure. Ask through the contact form.
Found something? Use our contact form — security reports get read first.