Security

Your data on your computer

Profiles run in a browser on your computer and their data is stored there. While a profile is open, anyone with access to your signed-in computer account can see it; use disk encryption and a screen lock.

Backups

Before a backup leaves your computer it is compressed and encrypted with AES-256-GCM using a new key for every backup, which is itself protected by your workspace’s key. Restores check the size and checksum of every backup before decrypting, and keep the previous data aside until the new data is in place.

Backups are not end-to-end encrypted: the service can technically decrypt them for restores, under access controls and audit.

Accounts and access

• Sign-in uses a standard identity provider (OpenID Connect with PKCE). The desktop app keeps its session in your system’s keychain; the website uses a secure, HttpOnly cookie.
• Access is denied by default: people see only the profiles shared with them, and every request is checked on the server.
• Signing a computer out, removing a member or changing access applies at the next request; profiles they have open are closed in their app.
• Our support staff use separate accounts with a one-time code at every sign-in. Seeing a customer’s members or activity needs a time-limited approval by a second person, and is logged.

Payments

Payments are made on our payment provider’s pages. We never receive card numbers.

Releases and updates

Every release is signed, and the app verifies each update before installing it. Releases carry checksums, a build provenance attestation and a software bill of materials.

Report a vulnerability

Please tell us privately: use the contact form with the topic “Security”, or GitHub’s private vulnerability reporting on our repository. Test only against your own account, do not degrade the service, and give us reasonable time to fix the problem before disclosing it.