Security
Security that never costs you a feature.
Every control is either transparent or opt-in.
Security controls
Credentials
Passwords stored with PBKDF2-HMAC-SHA512 (FIPS-approved), upgraded transparently at sign-in
Multi-factor authentication
Authenticator codes with recovery codes; passkeys (WebAuthn); every sign-in path covered
Workspace policy
Require MFA, restrict by IP allowlist, bound session length
Step-up authentication
Sensitive actions ask the user to confirm again
Enterprise identity
SSO via OIDC and SAML, SCIM 2.0 provisioning, group-to-role mapping
Audit
Tamper-evident, hash-chained security audit log, SIEM export (CEF), retention policy
Authorization
Enforced by the server on every request; hiding a button is never a security control
Data export controls
Rate limits on routes that return large volumes of data
Infrastructure
Database never exposed publicly; secrets read from files; hardened runtime images
Supply chain
Secret, dependency and code scanning on every change; SBOM and signed images per release
Roadmap
In progress and planned
Database isolation
A least-privilege role and row-level security per workspace.
Encryption and bring-your-own-key
Envelope encryption, key rotation, KMS or local key file.