Security Policy

Security is implemented as a default, not bolted on. This page documents the security measures in place and how to report vulnerabilities.

• All data in transit is encrypted via TLS/HTTPS.
• HSTS is enforced with a 1-year max-age including subdomains.
• File storage uses private AWS S3 buckets. Guest access is via presigned URLs with a 1-hour TTL.
• Database connections use TLS.
• MongoDB Atlas provides encryption at rest.

• Security headers applied globally: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), X-XSS-Protection, Referrer-Policy, Permissions-Policy.
• Authentication via Google OAuth only — no passwords stored.
• JWT tokens carry minimal claims and are verified server-side.
• CSRF protection on all mutation operations via Auth.js.
• All database queries on tenanted models are scoped to the authenticated organization.
• Stripe webhooks are verified by signature before processing.
• Webhook event IDs are stored to prevent replay attacks.

• BYOK OpenAI API keys are encrypted with AES-256-GCM using a server-side encryption key.
• The encryption key is stored as an environment variable and never exposed to clients or logged.

If you discover a security vulnerability, please report it responsibly by emailing [email protected] (or [email protected]) before publicly disclosing it. Include a description of the vulnerability, steps to reproduce, and the potential impact.

We will acknowledge your report within 72 hours and provide a resolution timeline.

Formal compliance certifications (SOC 2 Type II, ISO 27001, PCI-DSS) are not currently in place.