Security
Security is the product.
An executor is trusted with other people's things. We are trusted with the record of them. Here is how we treat that responsibility. The controls are designed to SOC 2 and GDPR standards; see our compliance documentation for the control mapping.
Multi-factor authentication, required
Every user must enroll an authenticator app (TOTP) before seeing any data. Recovery codes are single-use and stored only as Argon2 hashes. Passkeys are on the roadmap.
Encryption in transit and at rest
TLS 1.2+ everywhere. Cloud SQL volumes are encrypted; MFA seeds are additionally encrypted with AES-256-GCM using a key held in Google Secret Manager.
Tenant isolation & least privilege
Every record is scoped to your organization at the query layer. Staff roles are limited to the asset categories you grant. Sensitive fields are structurally excluded from public scan pages — not just hidden by the UI.
Hardened sessions
15-minute access tokens, rotating 30-day refresh tokens in HttpOnly cookies, device list with one-click revocation, account lockout after repeated failures, and rate limits on every auth route.
Immutable audit trail
Sign-ins, MFA events, role changes, exports, label prints, and public scans are recorded with hashed IP and user agent. Auditors get read-only access to the full log.
Infrastructure & your rights
Web on Vercel with strict CSP and HSTS. API on Google Cloud Run with a private Cloud SQL connection, automated backups, and point-in-time recovery. Files live in a private Cloud Storage bucket served by short-lived signed links. Export everything or delete your organization yourself, any time.