We sell security.
Of course we use it on ourselves.

AES-256-GCM at rest

Every customer credential we store (Cloudflare tokens, GitHub OAuth, Slack webhook URLs) is encrypted with AES-256-GCM via a versioned `ENCRYPTION_KEY`. Database backups inherit the same encryption.

TLS 1.3 in transit

All API endpoints enforce TLS 1.3; SSL Labs A+ rating with HSTS preload. We probe our own outbound TLS posture daily and alert if the score regresses.

Hardware-backed MFA

Owner accounts must enrol TOTP MFA within 2 days of signup; aal2 enforcement across the dashboard. WebAuthn/Passkeys land Q3.

SOC 2 aligned controls

We run 20 of the SOC 2 Trust Services Criteria controls continuously against our own platform. Evidence collection is automated.

Continuous self-monitoring

Our own scanner runs against our own domains. We eat our own dog food — every check we sell, we run on ourselves daily.

Our live score badge is activating — check back soon for the real-time number.

Regional residency — on the roadmap

Per-tenant data-residency pinning (EU / US / APAC) is architected in our schema and codebase, but not yet live — every organisation is stored in the same single-region Supabase project today. See the Trust Centre for current status.