Legal

Security Overview

Last updated 2026-10-14. Operator: AINT Labs (Alberta, Canada).

Architecture

The application runs on Cloudflare Workers with a D1 database and KV file storage. All traffic is served over HTTPS with HSTS. Data is encrypted at rest by the platform provider.

Tenant isolation

Every record is scoped to an organization and every write goes through server-side permission checks tied to the signed-in user’s role. Automated tests exercise cross-tenant access attempts.

Authentication

Passwords are hashed with PBKDF2-SHA256 (100,000 iterations). Sessions are random 256-bit tokens stored hashed, HttpOnly, SameSite=Lax. Email verification, password reset and invitations use single-use expiring tokens. Rate limiting and optional Turnstile bot protection apply to sign-in, sign-up and public forms.

Files and evidence

Uploads are type- and size-limited, hashed with SHA-256, stored in private storage, and served only to members of the owning organization through authenticated, logged downloads. Private buckets only.

Audit

Actions are recorded in an append-only, hash-chained audit log per organization.

Website scanner safety

The scanner reads public pages only, respects robots.txt, blocks private and link-local addresses, follows a limited number of redirects with re-validation, and caps time and bytes.

Responsible disclosure

Report vulnerabilities via the contact page. We acknowledge within two business days.

What we do not claim

We do not hold SOC 2 or ISO/IEC 27001 certification at this time and we do not claim Canada-only data residency for every component.