Security
Safe from day one
A company’s information is precious, so safety comes first, not last. Locks added later are far harder and riskier than locks built in.
Four foundations
The strong walls and locks
Every company gets a locked house
Many companies share one platform but each lives in a separate house with its own key. Isolation is enforced at the data layer, not just the screen, and it was built from day one because adding locks later is much harder and riskier.
Badges decide who opens which door
Not everyone should see everything. Each person gets a role and each role has fine-grained permissions. New sign-ups see what the product’s modules are, not real data, until an admin grants access.
A diary that can never be erased
Every privileged action is written to an append-only audit log: who did what, and when. If something goes wrong we can look back and see exactly what happened.
Strong logins
Passwords plus a second factor, with passkey support through Better Auth. A stolen password alone is not enough to get in.
Defence in depth
Every layer checked
Beyond the four foundations, every module meets the same bar before it ships.
Encryption at rest and in transit
Rate limiting per organisation and per IP
Secure headers: CSP and HSTS
Input validation at every boundary
Parameterised queries by default
CSRF strategy for cookie sessions
OWASP Top 10 checked before each module ships
Secrets in environment variables, never in code
A deliberate choice
Why chat is not end-to-end encrypted
Admins and auditors must be able to review company communications. So we protect messages in transit and at rest, and keep the audit trail intact.
Questions about security?
We are happy to walk your technical team through the architecture.