Security that is part of the product
Access rules are built into every request, not added on top. Here is what protects your organization's work today.
-
Organization isolation
Every organization's data is scoped on the server for every query. Records from another organization are never loaded, and their ids simply return "not found".
-
Roles and project access
Owners, admins, members and guests, a permission matrix your owners control, and manager, member and viewer roles per project. Private workspaces and projects are enforced on the server.
-
Two-step sign-in
Authenticator-app codes with one-time recovery codes, sign-in rate limiting, identical errors for wrong emails and passwords, and other sessions signed out after a password change.
-
Private files
Attachments are stored privately under generated names and served through short-lived signed links after a permission check.
-
Validated input
Every form and API call is validated on the server. Rich text is sanitized before it is stored, so scripts and unsafe links never reach other people.
-
Audit log
Sign-ins, membership and permission changes, and work changes are recorded in an append-only log that owners and admins can filter and export.
-
API tokens
API tokens are stored only as hashes, shown once, limited to one organization, read-only by default, and can expire or be revoked at any time.
-
Mailbox connections
Mail servers are reached only on mail ports and public addresses, with certificates checked. Mailbox credentials are encrypted at rest and each mailbox is private to its owner.
Bring your team to a safer workspace
Create your organization in a few minutes. Invite the team, set up your first project and start talking where the work is.
Free during early access. No credit card.