Security Practices

Authentication

• Secure HTTP-only authentication cookies for browser sessions.
• Password reset and email verification tokens stored as hashes with expiry and single-use consumption.
• Team invite tokens with expiry, revocation, acceptance state, and audit events.
• API keys stored as hashes with configured pepper, scoped permissions, rotation, revocation, and admin review.

Authorization and tenant isolation

• Implemented role-based authorization policies for owner, admin, and operational areas.
• Account-scoped tenant resolution before protected account records are loaded or mutated.
• Admin endpoints require authenticated role checks and record operational decisions in audit logs.
• Credential-varying output cache controls prevent cross-user cached responses for protected API calls.

Data protection

• SQL Server access uses parameterized `SqlCommand` paths and auto-provisioned migrations.
• Google OAuth state and refresh-token storage use ASP.NET Core Data Protection.
• Production secrets are kept out of source-controlled default appsettings and belong in environment-specific secret configuration.
• Retention settings, legal holds, dry-run cleanup previews, and deletion workflows are managed through privacy operations.

Integration safeguards

• Outbound REST, LLM, email, Stripe, and database operations use timeout, retry, jitter, and circuit-breaker resilience where applicable.
• Mailgun product email is separated from outreach SMTP/IMAP mailboxes.
• Stripe webhooks and Mailgun webhooks are signature-validated and treated as security events when invalid or malformed.
• Starter trial and upgrade workflows are guarded by billing, activation-risk, and silent-denial controls.

Logging and auditability

• Dedicated `Log` tables store error logs, audit trails for large tasks, and LLM call traces.
• LLM traces include prompts, response metadata, model version, token counts, finish reason, and cost metadata.
• Operational errors are logged with enough context for diagnosis while public endpoints redact infrastructure and tenant details.
• Database connectivity failures still fall back to file-based logs where configured so startup and persistence failures remain visible.

Vulnerability disclosure and incident response

Security reports go to the security contact page. Operational incidents should be reflected on system status when they affect customers. Confirmed personal-data breaches are handled through customer notice and privacy operations according to the DPA.