可以拿给审计人员看的安全。

Two-factor authentication (TOTP), optional or required per organization

Owners and admins can be required to use a one-time code. Codes cannot be reused and the secret is stored encrypted.

Since

2026-10-10

Evidence

api/src/lib/totp.tsapi/src/auth-security.test.ts

Passwords stored with scrypt; session tokens stored only as hashes

Passwords use scrypt with a per-user salt. Session and one-time tokens are kept only as hashes, so a database read does not reveal a usable token.

Since

2026-10-10

Evidence

api/src/auth/local.tsapi/src/auth-security.test.ts

API keys shown once, stored hashed, with scope, expiry and rotation

A key's secret is displayed only when it is created and stored as a keyed hash. Keys can be limited to one scope, expire, be rotated and be revoked immediately.

Since

2026-10-10

Evidence

api/src/lib/apikey.tsapi/src/api-keys.test.ts

Row-level isolation between customers, enforced in the database

Every table with customer data has row-level security forced on, and the application connects with a role that cannot bypass it. A generated test checks every such table.

Since

2026-10-10

Evidence

api/migrations/0001_init.sqlapi/src/rls.test.ts

Tamper-evident audit log

Sensitive actions are appended to a hash-chained log that the database refuses to update or delete. Owners can verify the chain and export it.

Since

2026-10-10

Evidence

api/src/lib/audit-chain.tsapi/migrations/0004_audit_chain.sql

Application-level encryption of stored secrets (AES-256-GCM)

Webhook secrets and two-factor secrets are encrypted before they reach the database. The key lives outside the database.

Since

2026-10-10

Evidence

api/src/lib/field-crypto.ts

Telemetry without IP addresses and with rotating device identifiers

The raw device ID is never stored; the stored hash changes every 30 days and differs per app. IP addresses are stripped before ingestion and kept out of logs.

Since

2026-10-10

Evidence

api/src/privacy/index.tsapi/docs/privacy/field-inventory.md

Retention limits by plan, data export and erasure on request

Events are deleted after the period of the plan. Customers can export their data and erase events by period or by device.

Since

2026-10-10

Evidence

api/src/retention/index.tsapi/docs/pulse/retention.md

Origin checks on state-changing requests and rate limits on sensitive routes

Requests that change data from a browser session must come from an allowed origin. Login, sign-up, writes and ingestion are rate limited.

Since

2026-10-10

Evidence

api/src/plugins/auth.tsapi/src/lib/ratelimit.ts

Outbound webhooks signed and protected against server-side request forgery

Webhook payloads carry an HMAC signature. Destinations in private, loopback and cloud-metadata ranges are refused, including after DNS resolution, and redirects are not followed.

Since

2026-10-10

Evidence

api/src/lib/ssrf.tsapi/src/webhooks.test.ts

Vulnerability disclosure contact published (security.txt)

A security.txt file (RFC 9116) tells researchers where to report. The mailbox depends on the company domain, which is not registered yet.

Since

2026-10-10

Evidence

landing/public/.well-known/security.txt

Documented process and deadlines for reported bypasses

A written process sets response deadlines by severity (7, 14, 30 and 90 days) and how a fix is published after the reporter agrees.

Since

2026-10-10

Evidence

api/docs/security/bypass-response.md

Incident response runbooks and severity levels

Runbooks cover outages, stuck queues, leaked artifacts, compromised keys, public bypasses and abuse, with severity levels, roles and communication templates.

Since

2026-10-10

Evidence

api/docs/ops/incident-response/README.md

Cookie consent where refusing is as easy as accepting

Analytics and marketing scripts load only after consent. Global Privacy Control and Do Not Track are treated as a refusal.

Since

2026-10-10

Evidence

landing/src/lib/consent.ts