Security
Encryption, access protection, logging and backups.
Encryption
- In transit: HTTPS only, with HSTS.
- At rest: The database and file storage are encrypted. Files sit in private buckets and are delivered only through short-lived signed links.
- Third-party credentials (cloud storage, Slack/Teams, mailboxes, own AI keys, database passwords): envelope encryption with AES-256-GCM. Each value has its own data key, encrypted with a master key in a key vault. Every decryption is logged.
Access protection
- Passwordless sign-in: Google, Microsoft, magic link or passkey.
- Two-factor requirement per team (passkey or TOTP app). → Two-factor sign-in
- Daily re-confirmation of your identity.
- Roles and permissions per area, set separately for AI clients. → Roles & permissions
- MCP sign-in via OAuth 2.1 with PKCE; access tokens are stored only as a hash and expire after one year at the latest.
Traceability
Changes are logged with person, time and source (app, chat, MCP). → Audit log
Backups
- Database: daily backup at the hosting provider. A restore returns to the state of a daily backup.
- Documents: Uploaded files are stored in the hosting provider's file storage in the EU.
- Your own copy: With document backup, your originals are also stored in your SharePoint or Google Drive.
Reporting security incidents
Please send vulnerabilities or suspected incidents to hello@zahlenwerk.studio.