How we protect your account and your sites

Account access

• We only store a scrambled version of your password (a salted hash), never the password itself. Not even our team can read it.
• Passwords have at least 10 characters.
• Sign-in codes are valid for 10 minutes and reset links for 1 hour. Both work only once and are also stored only as a hash.
• The code and reset screens respond the same way whether or not the account exists, so they don't reveal who is registered.
• Repeated sign-up, sign-in, code and reset attempts are blocked for a few minutes.
• Google sign-in only accepts accounts with a verified email.

Sessions

When you sign in, your browser gets a session cookie that page scripts can't read, that only travels over HTTPS in production and that isn't sent with requests made by other sites. It lasts up to 30 days, and our database keeps only a hash of it. Sign out ends the session in that browser, and deleting the account ends all of them.

Each customer's data kept apart

• Every project, lead and integration belongs to a workspace, and the system only looks that data up through the workspace of the person signed in.
• The AI only edits projects in your workspace.
• Each published app with a database has its own area in the database, with its own exclusive access: one app can't read another's data. See Data isolation.
• Integration credentials are held by a separate connection service, kept apart per customer; the project stores only a reference to the connection.

Protection in the browser

• The dashboard and published sites are served over HTTPS, and custom domains get a certificate automatically.
• The dashboard can't be loaded inside other sites' pages, which blocks tricks that hide its buttons under another page.

What you can do

• Use a long password that you don't use for other services.
• Don't share your password; each person should have their own account.
• On shared computers, click Sign out when you're done.
• Our sign-in emails only contain a code or a reset link. Be wary of messages asking for your password.

Found a security issue?

Write to [email protected] with the details, or use the contact form with the security topic.

Frequently asked questions