Built for change records that auditors read.

Accounts and sign-in

• Passwords of 12 or more characters, checked against the account name; stored with scrypt. Repeated failures lock the account.
• Time-based one-time codes (TOTP) with single-use recovery codes. Required for every member on Team and Enterprise, and for all platform staff.
• Single sign-on with OpenID Connect (Entra ID, Okta, Google) on Enterprise, with verified domains and domain capture.
• Sensitive actions (approvals, security settings, billing, tokens, exports) need a fresh second-factor confirmation.

Access control

• Roles: owner, admin, engineer, reviewer, change approver (CAB) and read-only auditor. Separation of duties is enforced on every record.
• API tokens are scoped, hashed at rest, and cannot approve changes or reach account, security or billing settings.
• Enterprise: IP allowlists, session length and idle limits, data retention.

Isolation and data

• Each organisation's records live in a separate database. Platform staff see organisation name, plan and usage, and have no path into your records.
• Secrets you store (SMTP, SSO, tokens) are encrypted at rest and never shown again in the interface.
• Every security-relevant action is written to a hash-chained audit log you can export and verify.
• Full data export at any time; deletion on request.

Application

• Strict Content-Security-Policy, no third-party scripts except the payment form on the billing page, CSRF protection, secure cookies, HSTS.
• Uploaded evidence images are identified by their file header, not their name, and each file is hashed (SHA-256) into the record.
• Payments are handled by Razorpay; card details never reach our servers. Webhooks are signature-verified and replay-protected.

Reporting a vulnerability

Write to the security contact listed in /.well-known/security.txt. We acknowledge within two working days.