Security
What we protect, written so you can check it.
From workspace isolation to data deletion, each item below says how it works.
Certification
ISO 27001 certified information security management
We hold the certification for our information security management system. The rest of this page rests on the code, not on an external audit.
Workspace isolation
- Checked on every requestEach read and write first confirms that the caller is a member of that workspace. The check runs in the application, on every request.
- One workspace never reads anotherAn account can belong to several workspaces, but a session only ever sees data from the one it has open.
- Deleting a workspace is immediateA workspace is removed at once, with no waiting period. Account deletion works differently.
Encryption
- In transitTraffic moves over HTTPS only. HSTS is set to two years, so a browser will not fall back to plain HTTP.
- Stored secretsThe SMTP password and the Slack connection's token and webhook URL are stored encrypted with AES-256-GCM.
- Account sign-inNo passwords are stored. One-time email codes are kept only as hashes and expire after 3 minutes; Google and Microsoft sign-ins are verified by those providers.
Access control
- Roles narrow what a member can doOwner, admin, editor, and viewer, with a job seat capping each member on top. A seat can only narrow access, never widen it.
- Sign-in method controlsWorkspace owners choose which sign-in methods and email domains members can use. Allow only Google and Microsoft, and sign-in follows those accounts' own security settings, two-step verification included.
- Sign-in attempts are cappedIn each fifteen-minute window, sign-in codes can be requested up to 5 times per account and 20 per IP address, and entered up to 10 times per account and 30 per IP address.
- Idle sessions end after 24 hoursA session ends after 24 hours without activity. A change to a sign-in policy applies from the next page load or action.
What gets recorded
- Audit trailActions that are hard to undo, adding or removing a member, changing a role, deleting, record who did it and when.
- Newsroom readsWho opened your newsroom and what they read is visible to that workspace only. It never crosses to another customer.
- Crisis Q&A drafts stay insideThe AI crisis Q&A draft has no external sharing feature. The capability was never built.
The data belongs to whoever put it in
- Take it out wheneverRequest a download of your data from account settings, once every 24 hours.
- Account deletion waits 30 daysAsk to delete and it is scheduled 30 days out. You can undo it in the meantime.
- Trash keeps 30 daysDeleted items sit in the trash for 30 days before they are cleared.
If you find a vulnerability, tell us. We confirm it, write back, and record the fix in the release notes.