Security
What follows describes controls that are implemented and testable. It is not a certification claim: we are not SOC 2, ISO 27001 or FedRAMP audited, and we do not say otherwise.
Your data is separated from other customers'
Every private table carries the organization that owns the row, and the database itself refuses to return rows outside the organization the request was authorised for. Application checks and database policies are enforced independently, so one of them failing is not enough to leak data.
Accounts
Passwords are stored with Argon2id. Email addresses are verified. Two-factor authentication is available to every account and mandatory for our own staff.
Documents
Uploaded files are stored privately, are never executed, and are parsed in an isolated process with no network access. We do not share your documents with other customers, and identical files are not deduplicated across accounts.
Reporting a problem
If you believe you have found a vulnerability, contact us before disclosing it publicly. We will confirm receipt and keep you updated.