TRUST CENTER
Security
The service is designed around tenant isolation, least-privilege source access, encrypted credentials, and server-side authorization.
Effective August 3, 2026
Authentication and authorization
Authentication is handled by the hosting identity layer. Passwords are not stored by the application. Every application API resolves the authenticated user and workspace on the server. Board sharing grants viewer or editor access to one board without granting access to source credentials or unrelated boards.
Encryption and secrets
Connection credentials and new snapshots are encrypted with AES-GCM using random initialization vectors. Runtime encryption keys and shared OAuth application secrets are kept outside the application database. Webhook tokens are stored only as SHA-256 hashes.
OAuth and integrations
OAuth state is single-use and expires after ten minutes. PKCE is used where supported. Provider permissions are limited to the scopes required for the selected reports. A connection can be disabled or removed without deleting the rest of a workspace.
Operational controls
Scheduled jobs use daily idempotency keys to prevent duplicate successful runs. Run failures are recorded without returning secrets to the browser. Production responses include transport, framing, content-type, referrer, and browser-permission security headers.
Your role
Use trusted identity accounts, review provider permissions, remove connections you no longer use, share boards only with intended recipients, and revoke provider access immediately if you suspect compromise.
Reporting a concern
A dedicated security-reporting address and response policy will be published with the final production domain before general availability. Do not include credentials or access tokens in a report.