Signing in and sessions
Passwords are stored hashed, never as text. You can sign in with a username or an email, and the session is held behind an httpOnly cookie that page scripts cannot read; the copy kept in the browser is only for rendering your name and role, never for granting access.
Every session expires after 30 days, and you can see your live sessions and end any of them one by one. Changing a password, or an account being frozen, closes every live session at once.
Failed sign-ins are counted, for a username and for a network address, with different thresholds. An address is often a whole office behind one connection, which is why the strict counter is the one on the username.
Who can reach what
Every request checks permission on the server, not in the browser. Hiding a button was never a permission: if you cannot reach a project, its data is never sent to you in the first place.
Files are kept in private storage and their addresses are never public. Permission is checked every time somebody opens one, and the link that gets created lives for a few minutes at most.
If something does not exist, and if you are not allowed to see it, the answer is the same. Whether an id exists is itself information.
The lock, and what is yours to set
You can put a passcode lock on the app, applied automatically or with one tap, for when you step away from a screen that is still open.
Sign-in alerts and the session list show you what is happening in your account. If you do not recognise something, end it there and change your password.
The infrastructure
Traffic to the server is encrypted, and strict security headers sit on every response: a content policy, a refusal to be framed by another site, and no guessing at file types.
Keys for outside services are stored encrypted and are never returned by any API. A refresh token is a standing key to somebody's whole cloud account.
Every significant event is written to an audit trail only an administrator can read, and the ledger is never hard-deleted.
Reporting a vulnerability
If you find something, write to us from the contact page and pick the security team. Send the details and the steps to reproduce it, and hold off on publishing until it is fixed. You will get an answer.