Each organization’s data is kept apart
- Everything in a workspace belongs to one organization: notes, positions, plans, budgets, members’ roles and the audit log.
- The database itself enforces this. Each request runs as a limited database user that can see only the rows of the organization you are working in.
- Automated tests check that every table with an organization’s data has this rule, and that a person from another organization cannot open any of your records.
- Public records, such as places, public bodies, meetings and public documents, are shared by everyone, and no workspace can change them. Documents you upload stay private to your organization.
Who can see and change what
- Every member has a role, such as owner, editor, researcher or reader. The server checks the role on every request, not only on the screen. See Admin.
- A project can be restricted to the people who work on it, and information barriers can hide it from members who must not see it. See Projects.
- Publishing, approving and sending always need a person. AI never changes your data on its own: what it proposes waits for a person to approve it. See AI.
Signing in
- Accounts and sign-in are handled by Clerk, a company that provides sign-in services. The service checks your session on every request.
- On the Enterprise plan, your organization can require sign-in through its own identity provider (SAML 2.0 or OpenID Connect) and add and remove members automatically (SCIM 2.0). See Single sign-on and directory sync.
Passwords and keys you give us
- Secrets your organization gives us are encrypted in the database: the access tokens of connected accounting, calendar and chat tools, webhook signing secrets, and Enterprise sign-in and storage credentials. The encryption key is kept outside the database, and keys can be replaced without losing data.
- API keys and directory-sync tokens are not stored at all. Only a fingerprint (a hash) of each is kept, so the service can check a key but cannot read it back.
A record of every change
- Every change is written to the audit log in the same step as the change itself. If the audit entry cannot be saved, the change does not happen.
- Nobody in your organization can edit or delete an audit entry, owners included. Entries are kept for at least seven years. See Admin and Audit log export.
- When the people who run the platform act on a workspace, that is recorded too.
- Reading personal records, such as contacts, members and expenses, is written to an access log that owners can read.
Your data stays yours
- Your organization can export all of its data at any time.
- Owners choose how long each kind of personal record is kept, above a minimum. Every night, older records are deleted or anonymized. See Retention.
- A person can ask your organization for a copy of what it holds about them, or for it to be erased. Owners handle these requests in the app. See Data requests.
- The app has no place for voter files, donation records, party registration or personality profiles, and automated checks keep such fields out. Its AI is not allowed to guess traits of private individuals.
Limits on traffic
Requests are limited per network address and per organization, by kind of request, so one person or script cannot slow the service down for everyone else. See Rate limits.
Backups
The database can be backed up and restored with scripts that check the restored copy, and a first restore drill has been run and recorded. The backup schedule and the recovery time targets for the live service are not confirmed yet.
Security reviews
- We reviewed the code against the OWASP Application Security Verification Standard (ASVS), level 2. It found one serious problem, which is fixed. A few smaller findings are still open.
- A test by an outside security company (a penetration test) is being prepared. It has not taken place yet.
- The service has no security certification yet, such as SOC 2.
Where your data is stored
The shared service runs on Railway, a cloud hosting company, in its us-west2 region in the United States: the app and its database. Accounts and sign-in are held by Clerk. An Enterprise organization can also have a dedicated deployment: its own copy of the service, with its own database and file storage.
Report a security problem
If you find a security problem, write to [email protected].