Current controls
- Encrypted HTTPS transport, strict browser security headers, and private evidence-object storage.
- Authenticated workspace boundaries and organization roles for operational, review, and publication actions.
- Expiring, revocable supplier and assurance capabilities with bounded disclosure.
- File size, type, extension, and content-signature checks before evidence admission.
- Server-authoritative billing, API-key custody, webhook verification, request limits, and destination controls.
- Fingerprinting, immutable revision records, audit-chain verification, encrypted recovery archives, and restoration drills.
Shared responsibility
Customers control membership, evidence scope, supplier recipients, publication decisions, retention choices, and credentials for their integrations. Use individual accounts, remove former members promptly, review every extracted field, and publish only information authorized for public disclosure.
Report a vulnerability
Send a concise description, affected URL, reproduction steps, and impact to the verified contact published when self-service terms activate. Do not access another customer's data, degrade the service, use social engineering, or publicly disclose an unresolved issue. We will acknowledge legitimate reports and coordinate remediation without promising a bounty.
Assurance boundaries
This page describes implemented product controls; it does not claim a third-party certification or guarantee that no incident can occur. Security questionnaires, contractual commitments, and enterprise evidence are available through the support channel when agreed in writing.