Security
What we do, and what we do not claim
Finance and compliance teams rightly ask hard questions. Here are the controls in the product today, in plain words, and the certifications we do not hold.
Controls in place
Tenant isolation at the database
Every tenant table carries an organisation id and is protected by PostgreSQL row-level security with FORCE enabled. The application connects as a role without superuser or bypass privileges, and each request sets the organisation scope inside the transaction. A query that forgets its filter still cannot read another tenant's rows.
Server-side authorisation on every action
Session and organisation membership are re-checked inside each server action and data read. Role checks (owner, admin, member) happen on the server, never only in the interface.
Encrypted transport and secure cookies
All traffic is served over HTTPS with strict transport security. Session cookies are HTTP-only and same-site. Passwords are hashed by the authentication library; we never store them in plain text.
Documents are untrusted data
Regulatory documents are fetched only from an allowlist of official hosts, with size and time limits, and are never executed, rendered as HTML or allowed to act as instructions to the system or to any AI component.
Audit and security logs
Tenant actions are written to an audit log with actor, action, entity and time. Rate limiting, forbidden access and suspicious fetches are recorded as security events for review.
Rate limiting and abuse controls
Public forms carry a honeypot field and per-connection rate limits. Authentication endpoints use the authentication library's database-backed limiter. Scheduled jobs require a shared secret.
Secrets outside code
Credentials live in environment configuration, never in the repository, logs or chat. Only a template with placeholder values is committed.
Minimal data
We hold what the service needs: account, profile, workspace, lead and log data. No card details. No third-party trackers.
What we do not claim
- No SOC 2, ISO 27001 or similar certification. We will say so until one exists.
- No independent penetration test has been published yet. We welcome responsible disclosure in the meantime.
- No on-premise or Bangladesh-resident hosting option today; data is held with a managed provider abroad.
- No guarantee of availability unless agreed in writing. Source websites are outside our control.
- Backup and restore procedures will be published before paying customers are onboarded.
Responsible disclosure
If you believe you have found a vulnerability, email us with “Security” in the subject. Include steps to reproduce. We acknowledge reports within three working days, do not pursue good-faith researchers, and credit you if you wish once the issue is fixed. Please do not access other customers' data or run automated scanners against production.