Controls
- Passwords hashed with bcrypt; sessions are random tokens stored only as an HMAC.
- Connector credentials sealed with AES-256-GCM using a key held outside the database.
- Strict content security policy, HSTS, frame denial, no shared caching of signed-in pages, and pages carrying one-time links are never cached.
- Cross-origin requests to state-changing endpoints are refused; sign-in and sign-up are protected by Turnstile and rate limits.
- Every import, letter, status change, recovery, plan change, setting change and closure is written to an audit log with the actor.
- The platform console sits behind Cloudflare Access with a named-person allowlist, verified again at the origin.
AI
Money is decided by rules, never by a model. The model only words letters and reads the text of PDFs you send. Calls are cached and capped per workspace per day.