Security

Sign-in and access

• You sign in with a one-time link sent to your e-mail. The link works once and for a limited time. There are no passwords to leak.
• The session is a signed token in an HttpOnly cookie that is only sent over an encrypted connection. It is valid for 15 minutes and renewed during active use.
• Roles (owner, administrator, member) control what each user can do. Data is kept separate between organisations.
• AI clients connect with OAuth 2.1. The connection token has its own permissions and can be revoked in the workspace.
• The administration interface requires two-factor sign-in and is restricted to approved IP addresses.

Encryption

• All traffic to the service uses HTTPS. The websites sit behind Cloudflare, and our server has a valid TLS certificate.
• Backups are encrypted before they are stored off the server.
• Card details are handled by Stripe and never reach our servers.

Abuse protection

• Rate limits for public traffic, signed-in users, API keys and MCP connections.
• Protection against requests from other websites and restricted allowed origins.
• Personal identity numbers are never stored and are masked in texts and documents.

Logging and operations

• Administration, API keys and MCP calls are logged with time and tool name for 24 months for security and support.
• The parts of the application run as separate services. Secrets are kept outside the code.

Sub-processors and location

Servers and database are hosted by DigitalOcean in Frankfurt, Germany. See the data processing agreement for all sub-processors.

Incidents and vulnerabilities

Found a vulnerability or suspect an incident? Write to [email protected]. We reply as soon as we can. In case of a personal data breach we inform affected customers without undue delay and notify the Swedish Authority for Privacy Protection (IMY) when the law requires.