Your company runs on this data — CRM, finance, payroll, HR. Here's exactly how we protect it, in plain language. No jargon, no claims we can't back up.
Every workspace is a separate tenant. Data access is scoped to your tenant on the server for every read and write — enforced by the database key and the session, not by the browser. One customer can never see or modify another's records.
All traffic is served over TLS (HTTPS) — data is encrypted in transit. Your data is stored in a managed Postgres database with encryption at rest provided by the database host.
Billing runs through Stripe (PCI-DSS Level 1 certified). Card numbers are entered on Stripe's own checkout and never touch our servers — we only store your plan and a Stripe customer reference.
Export your records to CSV from every module, any time. There's no lock-in — your business data belongs to you and leaves with you.
Passwords are hashed with bcrypt, never stored in plain text. Sessions use signed, http-only cookies with a fixed expiry. Roles (owner / admin / manager / member) scope what each teammate can do.
Hosted on Vercel's global edge network with a managed Postgres database. Automated platform-level backups and high availability are provided by our infrastructure hosts.
The third parties we rely on to run the service, and what each one handles.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Application hosting & CDN | App traffic, request logs |
| Managed Postgres (Neon / Vercel Postgres) | Primary database | All workspace records |
| Stripe | Subscription billing | Billing email, plan, payment method (held by Stripe) |
We're honest about what isn't built yet. These are planned, not shipped — we'll update this page as each lands.
We take reports seriously. Email us and we'll respond quickly — responsible disclosure welcome.