Security

Specifics rather than reassurance. The last section is what we do not claim.

Passwords and sessions

Passwords are hashed with scrypt and a per-user salt; they cannot be reversed.
Only a SHA-256 of the session token is stored, so a database leak yields no working session.
Changing or resetting a password ends every other session.
Invite and recovery links are single-use and expire.

Third-party credentials

Mailbox and invoicing credentials are encrypted with AES-256-GCM. These must be replayed to the mail server, so unlike a user password they cannot be hashed.
The key is derived from a server secret and is not in the database.

Tenant separation

Every table is scoped to an organisation and every query filters on it.
This is machine-checked: the test suite fails if anyone writes a query that omits it.
The same applies to files and the API — another tenant's record is a 404, not a 403.

Uploaded files

Storage keys are generated, never derived from the filename — so “../../etc/passwd” is only a label.
Downloads are always attachments, and types a browser would execute (HTML, SVG) never get a permissive content type.

GDPR

One click exports everything held about a person, for a subject access request.
Erasure really deletes rather than archiving. Issued invoices remain for statutory retention, but with the reference to the person removed.
Both operations are audited.

What we do not claim

We hold no ISO 27001 or SOC 2 certification. If your procurement requires one, we are not the right fit today.
There is no 24/7 on-call rotation and no contractual uptime guarantee.
We have not commissioned an external penetration test.
If any of that is a blocker, say so — better to establish it now.

Found a security issue? Write to us and we will reply within 72 hours.