Security

Infrastructure

• Frontend served through Cloudflare Pages with enforced HTTPS and HSTS
• API hosted on Cloudflare Workers (edge computing)
• SMTP backend on an OVHcloud VPS, Roubaix datacenter, France
• Cloudflare D1 database (SQLite, encrypted at rest)

Authentication

• Authentication delegated to Clerk (SOC 2 Type II)
• Signed JWT tokens with short expiry
• Two-factor authentication (2FA) supported

API keys

• API keys are displayed only once, at creation
• Stored server-side as a hash, never in clear text
• Revocable at any time from the dashboard

Encryption

All communications are encrypted with TLS 1.3. Sensitive data (secrets, tokens) is encrypted at rest through the native mechanisms of each platform (Cloudflare Secrets, OVH disk encryption).

Reporting a vulnerability

Found a security issue? Contact us under responsible disclosure at [email protected] with the subject "Security Report". We commit to replying within 72 hours and fixing the vulnerability as quickly as possible.