We treat your business data — and your customers' — as something to protect. Here's how.
Encryption
All traffic to the Service is encrypted in transit (HTTPS/TLS). Sensitive credentials we hold for integrations are encrypted at rest.
Passwords and sign-in
Passwords are stored only as salted bcrypt hashes — never in plain text. You can turn on an email one-time code as a second factor at sign-in, and you can sign out every other device with one click if you ever lose one.
Tenant isolation
Every business's data is isolated at the database level using PostgreSQL row-level security, so one account's data can never be read or written by another. Our application connects with a restricted database role that cannot bypass these rules.
Sessions
Sessions are signed tokens that can be revoked server-side — a lost or stolen session can be invalidated immediately, and deactivated accounts lose access at once.
Payments
Card and bank details are handled by our payment processor (Stripe), a PCI-DSS Level 1 provider. We never store full card numbers.
Documents and signatures
Stored documents are kept in encrypted storage. Documents you send for signature are sealed with a tamper-evident digital signature, so a recipient can verify the file hasn't been altered.
Responsible disclosure
If you believe you've found a security issue, please tell us right away through our contact page and give us a chance to fix it before any public disclosure. We appreciate the help.