Docs / Security & privacy

Security & privacy

What’s encrypted, what’s isolated between accounts, and what’s still on the roadmap.

Account isolation

Every account's connections, tasks, projects, and settings are isolated from every other account at the data layer — not just hidden in the interface. A request for something that belongs to a different account is refused exactly the same way as a request for something that doesn't exist at all, so there's no way to probe for what exists elsewhere.

Passwords and sessions

Passwords are hashed with a slow, memory-hard algorithm (scrypt) designed specifically to resist large-scale guessing, and compared in a way that doesn't leak timing information. Sessions are random tokens stored in a cookie your browser can't read from JavaScript, marked to only travel over HTTPS in production.

Source-system credentials

Tokens and API keys for connected systems (Azure DevOps, Jira, and so on) are encrypted at rest and are never sent back to the browser — the connections list only ever shows a masked preview like abc••••••wxyz.

What's still on the roadmap

There's no email verification, two-factor authentication, or login rate-limiting yet. These are reasonable next additions as the product grows, not blockers to using it today — and the Google-linking safeguard above exists specifically because password signup doesn't verify email ownership yet.