Everything on this page describes controls that are actually running — no aspirations, no badges we don't hold. We name the vendors that touch your data in our privacy policy; we don't publish the rest of our infrastructure, which is itself a control.
Documents are stored encrypted at rest and served only through short-lived signed URLs (minutes, not days) scoped to the person viewing. Deleting your account purges the stored files, not just the database rows.
Every shared link is gated by an email code, scoped to a session, and revocable — revoking a link kills its active sessions immediately. Viewer pages carry watermarks and are excluded from search engines. Every view is logged for you. The system never confirms who does or doesn't have access to anything (no enumeration, anywhere).
No passwords to steal: LinkedIn OpenID Connect or single-use email codes. Codes expire in minutes, lock after repeated wrong guesses, and are throttled per address and per network — including an aggregate hourly lockout that can't be reset by requesting fresh codes. Session tokens are stored hashed; the LinkedIn access token is used once and never stored.
Every stored connection credential is encrypted at rest with keys derived via PBKDF2 (600k iterations), and access tokens are held only as long as they are valid — Stripe's expire hourly and are rolled automatically. Disconnecting a service wipes every credential we hold for it. Sign-in is the one place we store nothing: the LinkedIn token is used once and discarded.
Signed webhooks with replay protection. Rate limiting keyed to real client addresses (proxy-chain calibrated against production, so spoofed headers don't bypass it). Strict security headers on every host. API documentation endpoints disabled in production. Error messages never leak internals — details go to logs, not responses.
Dependency vulnerability scanning with prompt patching (most recently: framework-level CVEs cleared within days of disclosure). Migrations are tested up-and-down before deploy, staged on a separate environment with its own database before reaching production.
Document processing runs on commercial AI APIs — today Anthropic, and possibly OpenAI — under terms that prohibit training on your content. Prompts and outputs are scoped per workspace.
We don't yet hold SOC 2 or ISO certification — we're a small team and say so. If your diligence process requires a formal audit report, ask us and we'll show you the underlying controls directly.
Found something? Use our contact form — security reports get read first.