How we secure our own platform

Each site gets a public prefix and a secret. The secret is displayed exactly once and no endpoint returns it afterwards — the data layer projects it away rather than relying on each query to remember. Losing it means rotating the key, not recovering it.

Every report is HMAC-SHA256 over the exact bytes sent, plus a signed timestamp and a per-request nonce. That defeats forgery, replay of a captured request, and replay inside the timestamp window respectively. Forged telemetry would be worse than none — someone able to write into your timeline could manufacture an incident against an address of their choosing.

One module is the only way to reach customer data, and it never hands out a raw database handle. It merges the tenant filter itself, last, so a query cannot forget it or override it. An automated check fails the build if any route touches a collection directly.

Passwords are scrypt with per-user salts. Sessions are opaque random tokens stored hashed, not JWTs — so revocation is immediate rather than waiting for an expiry. Session cookies are HttpOnly, Secure and SameSite=Strict.

Card details go directly to our payment provider and never reach our servers or our database, which keeps the platform out of PCI scope entirely. A subscription is activated only by a signature-verified webhook — never on the browser's word, because the browser is the one party with a motive to lie about it.

Observations not linked to an incident are deleted after 14 days; incident evidence after 30 or 90 depending on plan. Deletion is enforced by database-level expiry rather than a scheduled job somebody can forget to deploy.