Security

Reporting a vulnerability

Do not open a public issue. Use GitHub's private vulnerability reporting on the repository or email [email protected]. We aim to acknowledge within 5 working days and to fix critical issues within 30 days of confirmation; details in the repository's SECURITY.md.

Credentials

• Project keys grant ingest only and are safe to ship in clients; secrets are shown once and stored as SHA-256 hashes.
• API tokens are hashed at rest, scoped, expiring and revocable.
• Sessions are short-lived EdDSA tokens issued by the accounts service and verified through its JWKS; refresh tokens rotate on every use and a reused token revokes the whole family.
• Passwords are bcrypt-hashed; 10 failed logins lock the account for 15 minutes.

Tenancy

Every row in ClickHouse and PostgreSQL carries its organization; every query is filtered by the organization in the caller's credentials. Project credentials never reach organization-level routes.

Transport and browser protections

TLS everywhere; containers bind to loopback behind nginx. The dashboard keeps sessions in httpOnly, SameSite cookies and requires a custom header on every mutating request, so cross-site forms cannot act on your behalf. Signup is protected by Cloudflare Turnstile and rejects disposable email domains.

Data location and residency

Hosted data lives in a single US region at launch. Self-hosted deployments keep everything on your infrastructure.

GDPR

• GET /v1/privacy/subjects/{uuid} exports everything stored about a person; DELETE erases it.
• Retention windows delete raw events automatically; audit entries record who exported or erased a subject.
• The cookie policy lists every cookie the dashboard sets; analytics and marketing tags load only after consent.

Compliance

Independent certifications (SOC 2, ISO 27001) are not in place yet. Ask for the current security questionnaire answers if your procurement needs them.

Contacts

• Security: [email protected]
• Privacy requests: the same address, or the erasure endpoint above
• Terms and privacy policy: linked from the footer of the landing site