Security

Passwords are stored as bcrypt hashes. We cannot read them. New passwords must be at least 10 characters, cannot be a common password, and are checked against known data breaches (only a short, anonymous part of a hash is sent for that check).

Sessions use signed cookies that page scripts cannot read. Signing out of all devices ends every session at once, and changing your password does too.

Repeated wrong passwords are slowed down: each failure makes the next try wait longer, and there are separate limits per account and per network address. A bot check can be switched on for the login page and forms.

Roles decide what each person can reach. Admin pages are for admins only, team members get only the permissions they are given, and clients see only their own data. Private community spaces return nothing to people who are not members, not even a title.

Changes to workflows, and who they are assigned to, are written to an audit trail that cannot be edited or deleted afterwards from within the site, and the database itself refuses such changes.

The site is served over HTTPS. It sends security headers that stop it being embedded in another site, limit where forms can post to, and restrict plugins. A content security policy is reported on and can be switched to enforcing from the admin settings.

Uploads are checked by their actual contents, not just their file name, and the number of uploads and sign-ups from one address is limited.

Data is stored in a PostgreSQL database that only the website's server talks to, never your browser. Payment card details are handled entirely by Stripe and never reach our servers. Short-lived security records (such as IP addresses used to stop abuse) are deleted automatically after 14 days. See the Privacy Policy and the list of subprocessors.

We do not currently hold a SOC 2 or ISO 27001 certification and have not had an independent penetration test published here. We do not offer two-factor authentication yet. If a certification or report matters for your decision, ask us and we will tell you plainly where we stand.

If you think you have found a vulnerability, please tell us before telling anyone else so we can fix it. Use the contact form on our homepage and mark it as a security report. Please do not access other people's data, and do not run tests that slow the site down. We will reply, fix real problems, and will not take action against people who report in good faith. Our contact details are also published in security.txt.