Your data is yours alone
Every request is checked against the organisation it names before any data is read. That check is proven by an automated test suite that tries to read and write across organisations on every endpoint, and runs on every change we make. The database also denies access by default to anything that bypasses the service.
Credentials we never keep in readable form
- API keys and webhook signing secrets — stored as hashes and shown to you once.
- Calendar feed links — stored as hashes.
- Slack and Teams webhook URLs — never shown back in full after you save them.
- Card details — held by Stripe, never by us.
History
Every change is written to an append-only event log in the same transaction as the change itself, recording who or which API key made it. A change cannot succeed without its record.
Reporting a vulnerability
Email us with the details. We reply to every report.