Security

Specifics rather than reassurance. The last section is what we do not claim.

Passwords and sessions

Passwords are hashed with scrypt and a per-user salt; they cannot be reversed.
Only a SHA-256 of the session token is stored, so a database leak yields no working session.
Changing or resetting a password ends every other session.
Invite and recovery links are single-use and expire.
Your profile lists your open sessions and ends any of them: a phone the same way as a laptop.

Signing in

Two-step verification with an authenticator app (RFC 6238), with hashed recovery codes. It can only be switched off with a valid code, and no administrator can switch off somebody else's.
Failed sign-ins count per email address and per IP address, and the answer is the same whether the address exists or not.
SAML 2.0 single sign-on and SCIM 2.0 user provisioning; the signature is verified with the certificate the company configured.
A per-organisation IP allow-list (CIDR) that applies to sessions and API keys alike.

Who sees what

Roles with a permission set (RBAC), per-record sharing (DAC) and optional classification and clearance (MAC): a classification overrides a share and even the record's own owner.
An "own records only" scope enforced in lists, search, export, pickers, reports, emailed reports and the AI assistant; field-level rules per role.
An audit log of who did what: sign-ins, exports, changes, deletions.

Third-party credentials

Mailbox passwords, connected-account tokens, courier and channel secrets and the two-step secret are encrypted with AES-256-GCM. These must be replayed to the other service, so unlike a user password they cannot be hashed.
The key is derived from a server secret and is not in the database.
A connected account's token can only be sent to its own service's addresses, and redirects are never followed: an automation cannot become a way to read the token.
Health charts are stored encrypted with AES-256-GCM, so a database backup does not reveal them, and every opening is logged.

Tenant separation

Every table is scoped to an organisation and every query filters on it.
This is machine-checked: the test suite fails if anyone writes a query that omits it.
The same applies to files and the API: another tenant's record is a 404, not a 403.

Uploaded files

Storage keys are generated, never derived from the filename, so “../../etc/passwd” is only a label.
Downloads are always attachments, and types a browser would execute (HTML, SVG) never get a permissive content type.

GDPR

One click exports everything held about a person, for a subject access request.
Erasure really deletes rather than archiving. Issued invoices remain for statutory retention, but with the reference to the person removed.
Both operations are audited.

Backups

The database and the uploaded files are backed up daily, together: an invoice whose PDF is missing is not a restore.
A copy can go to a second machine, and a weekly restore drill checks that the backup actually loads.
You can export everything to CSV at any time, and when a trial ends the account carries on on the Free plan, nothing is deleted.

What we do not claim

We hold no ISO 27001 or SOC 2 certification. If your procurement requires one, we are not the right fit today.
There is no 24/7 on-call rotation and no contractual uptime guarantee.
We have not commissioned an external penetration test.
If any of that is a blocker, say so: better to establish it now.

Where the data lives

Hosting provider: [Tárhelyszolgáltató / Hosting provider] · location: [EU]. Every subprocessor is listed on the subprocessors page. Self-hosted, the data stays on your own infrastructure.

Found a security issue? Write to us and we will reply within 72 hours.