Encryption in transit
TLS 1.2+ enforced on all endpoints, webhooks, and inter-service calls.
Managed disk encryption at rest
AES-256 provider-managed encryption on all database volumes and object storage. Backups are encrypted with the same standard.
Column-level encryption
Not currently applied to message bodies or attachment content. Passwords are bcrypt-hashed; API tokens are stored as SHA-256 hashes.
Row-level security (RLS)
RLS enabled on every table containing customer data; policies enforce workspace scoping.
Least-privilege access
Service-role credentials are never exposed to browsers or application code. Admin access requires MFA and is time-boxed.
Signed webhook verification
HMAC verification on every inbound channel (Slack, Postmark, helpdesks, payment providers).
Append-only audit log
Auditable actions are written to a log that no application role can modify or delete.
Rate limiting & abuse controls
Per-workspace and per-integration token buckets protect outbound quota, cost, and integrity.
Configurable retention
Per-workspace message retention with legal-hold override; deletions are irreversible after grace period.
Backups & restore
Point-in-time recovery covering the last 7 days on the primary database. Restore procedures are documented and tested at least annually.
Access reviews
Production-access list is reviewed quarterly by an engineering lead; departures trigger same-day revocation.
Vulnerability management
Automated dependency scans, periodic application security scans, and a public disclosure channel at /trust#reporting.
Data export & erasure
GDPR Article 20 export and Article 17 erasure endpoints available to workspace admins from the Data & plan section.
Incident response
Documented playbook with a 72-hour breach notification target under GDPR Art. 33. Customer contacts are notified via the workspace owner email on record.