Every sign-in and signup is confirmed with a 6-digit code sent to your email, or a one-time link.
Sessions use HttpOnly, Secure cookies. Idle sessions sign out automatically (15 minutes by default).
Integration keys and credentials you or we store are encrypted at rest and are never sent back to your browser.
Our database is backed up nightly, encrypted, to offsite object storage. Restores are tested.
Databases listen on the local machine only, not the public internet.
Rate limiting and signup fraud rules protect sign-in and signup. Cloudflare Turnstile support is built in.
Tickets, files and invoices are visible only to the account that owns them. We test this with cross-account checks.
We never store full card numbers. Payments go through the payment processors we integrate.
Found a vulnerability? Please report it through Contact (choose Abuse) and we will respond.