Docs

Security and your data

• Every request is checked against row-level security in the database, so one workspace can never read another.
• Files live in private storage and are served through links that expire after minutes.
• Client credentials stored on cards are encrypted with AES-256-GCM; each reveal is logged.
• Membership, invitation, token and settings changes are recorded in the workspace audit log.

Protect your account

Turn on two-step verification under Account → Security, and use Sign out of all devices if you lose a laptop or phone.

Export and delete

Admins can download the whole workspace from Settings → Export. Owners can delete a workspace (restorable for 30 days), and anyone can delete their account from Account → Delete account.