Legal
Security
Draft document. This content is a draft with placeholders in [brackets] and requires review by a qualified legal professional before publication.
Workspace isolation
Every record belongs to a workspace and is protected by row-level security at the database layer, so users can only read data from workspaces they belong to.
Credentials
Passwords are hashed by our authentication provider. API keys for AI and payment providers are kept server-side and never sent to the browser. We never ask for marketplace passwords; future integrations will use official authorisation.
Payments
Premium access is only granted after a payment is verified server-side by our payment provider's signed webhook.
Reporting
Report vulnerabilities to [security@yourdomain.com].