Security

1. Infrastructure#

• Production runs on major cloud providers in isolated environments, separate from development and testing.
• Workspace content is stored and rendered in the region you choose: the US or the GCC, with the EU available on Enterprise.
• Customer data is never kept on employee laptops.

2. Encryption#

• TLS 1.2 or higher for all traffic, with HTTP Strict Transport Security on our live site.
• AES-256 encryption at rest for databases, file storage and backups.
• Keys held in a managed key service and rotated at least every year.

3. Access control#

• Multi-factor authentication for every employee, on every system.
• Least privilege: production access is granted just in time, for a stated reason, logged, and reviewed every quarter.
• Access is removed the same day someone leaves.
• On Enterprise: single sign-on (SAML 2.0) and SCIM provisioning.

4. Application and sign-in security#

• No passwords. Sign-in uses one-time email codes, or Google, Apple or Microsoft accounts. Codes are stored only as one-way hashes, expire after 10 minutes, allow five attempts, and are rate-limited.
• Hardened social sign-in. OpenID Connect with state, nonce and PKCE; short-lived, signed cookies; return addresses limited to our own site. Email addresses that a provider can’t vouch for must be confirmed with a code.
• Sessions. Random tokens in httpOnly, Secure, SameSite cookies; only a hash of each token is stored, so a database leak can’t be replayed as a login.
• Request protection. Every change is checked for same-origin requests. Public forms and sign-up are protected by bot checks and rate limits, including limits on guessing invite codes.
• Isolation. Every query is scoped to the signed-in workspace; brand memory can’t cross between customers.
• Secure development. Code review before every change, dependency scanning on every build, and security headers on every response.

5. Logging and monitoring#

Centralised logs, kept for 12 months, with round-the-clock alerts on unusual access, error spikes and abuse patterns. Error reports have personal data removed before they leave our systems.

6. Vulnerability management#

An independent penetration test of the app and API is scheduled before general availability, with fixes re-tested. Researchers can report issues under our Vulnerability Disclosure Policy.

7. Incident response#

We have a written incident response plan that we rehearse twice a year. If a security incident affects your data, we tell you within 72 hours of confirming it, with what happened, what data is involved, and what we’re doing. Customers with a Data Processing Addendum receive the details they need to meet their own obligations.

8. Backups and continuity#

Daily encrypted backups, kept for 35 days, with regular restore tests. Our recovery target is 24 hours for a full region failure.

9. Vendors and people#

• Every provider that handles customer data is reviewed before use and bound by a written agreement. See Subprocessors.
• Background checks where the law allows; security and privacy training when people join and every year after; confidentiality agreements for everyone.

10. Security documents#

Request the security overview, the CAIQ Lite questionnaire, the penetration-test summary (under NDA) and more below.