Security and privacy
The measures in place today, described as they are, with no certification claimed.
Data isolated per company
Each workspace only sees its own data. This isolation is enforced on the server and checked by automated tests.
Roles and permissions
Each person sees their own data, their team's or the whole company's depending on their role, and only has the rights granted.
Two-factor authentication
One-time code from an app (Google or Microsoft Authenticator), with recovery codes.
Passwords and sessions
Hashed passwords, length rules, temporary lockout after repeated failures.
History and audit log
Changes to records are kept in a history; platform administration actions are logged.
Personal data
Tools to hand over or erase the data of a person who requests it.
Protected connections
In production, all pages are served over HTTPS with security headers.
Private pages not indexed
Only this public website is open to search engines; company workspaces never are.