Security & Data Breach Information

Security is built into how the platform is developed and operated. We apply least-privilege access, isolate customer data, encrypt traffic, limit and monitor privileged operations, and review third-party providers before they receive data. No service can be guaranteed completely secure, but we work to reduce risk continuously and to respond quickly when something goes wrong.

All traffic to and from the platform is served over HTTPS with modern TLS. Data is encrypted in transit, and stored data is encrypted at rest by our infrastructure provider. Credentials and API secrets are stored in an encrypted secret store and are never exposed to the browser.

Passwords are stored in hashed form by our authentication provider; we never see plaintext passwords. We support Google sign-in, email verification and password reset flows, session tokens with expiration, and role-based access within a workspace. Administrative access to production systems is limited to a small number of authorized personnel, requires strong authentication, and is logged.

Records are protected by row-level access rules, so one account can only read and modify its own data. Uploaded files are stored privately by default and served through short-lived signed links rather than public URLs. Sensitive fields — such as a connected mailbox credential or a form-delivery key — are restricted to the account that configured them.

We rely on established cloud infrastructure with physical security, network isolation, patch management and redundancy handled at the platform layer. Vendors that process personal data are listed in our Subprocessor List, are bound by confidentiality and data-protection terms, and are reviewed before onboarding.

We keep application and access logs to detect errors, investigate incidents and prevent abuse. Automated safeguards include rate limiting on public endpoints, allow-listing of file origins, protection against clickjacking and frame embedding, and validation of inbound requests to server functions.

Data is backed up regularly by our infrastructure provider, and restore procedures are tested. Backups are protected by the same access controls as production data and are deleted according to our retention schedule.

Suspected security incidents are triaged immediately by the team responsible for the affected system. We contain the issue, preserve evidence, determine the scope and cause, remediate, and then document lessons learned and adjust our controls. Incidents affecting customer data are handled under the notification commitments below.

If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and, where required, within 72 hours of becoming aware, together with the information needed for you to meet your own obligations: the nature of the breach, the categories and approximate volume of data affected, likely consequences, and the measures taken or proposed. Where a breach concerns your account as a customer, we will notify you by email and, where appropriate, in the product.

You are responsible for keeping your credentials confidential, enabling available security features, granting workspace access only to people who need it, and removing access when it is no longer needed. Do not upload special-category or highly sensitive data unless you have assessed the risk and have a lawful basis to process it.

If you believe you have found a security issue, please report it privately to petarbuisness010@gmail.com with steps to reproduce it. Do not access, modify or disclose other users' data, and give us reasonable time to fix the issue before publishing details. We acknowledge reports within 3 business days and will keep you informed of the resolution.