Encryption in transit & at rest
All traffic is served over TLS. Sensitive third-party credentials — Slack, Discord, and Microsoft Teams tokens, Google Chat webhook URLs — are encrypted at rest with AES-256-GCM.
Security is part of the product, not an afterthought
Your standups contain real work context. We treat that data with the care it deserves — here's how.
Scoped roles & access
Every action is checked against organization and team roles — owner, admin, lead, member — so people only ever see their own workspace's data.
Modern session security
Short-lived signed access tokens with rotating, httpOnly refresh tokens. Password resets revoke every active session instantly.
Hardened by default
Security headers, strict input validation, and per-route rate limiting protect the API against common abuse and injection vectors.
Your data is portable
Export standups and analytics to branded PDF or raw CSV at any time. There's no lock-in — your data is yours to take with you.
Trusted payment handling
Billing runs on Stripe. Card details are entered directly into Stripe's hosted fields — they never touch our servers (PCI SAQ A scope).
Everyday practices
- Passwords are hashed with scrypt — we never store them in plain text.
- Google Workspace and Microsoft 365 sign-in are both supported via OAuth, so you can avoid passwords entirely.
- Data is hosted on managed, reputable cloud infrastructure (Vercel & Neon Postgres).
- Webhooks are signature-verified before any payload is trusted.
- Suspicious or revoked tokens are rejected on the very next request.
Found a vulnerability? We appreciate responsible disclosure — emailour team and we'll respond promptly.
Security questions before you commit?
We're happy to walk your team through how StandupSync handles data.