Security overview

Platform security

• Cloudflare Workers isolates request execution at the edge; D1 is used for relational control state and R2 for immutable telemetry/replay objects.
• Encryption in transit and at rest, secure HTTP-only session cookies, secret-managed credentials and short-lived signed access.
• Tenant-scoped authorization and mandatory workspace predicates across query and export paths.
• Structured Workers logs and traces, incident response procedures, monitored auth/email delivery and change audit trails.

Application safeguards

• Better Auth passwordless magic link and email OTP with rate limits and session rotation.
• Origin allowlists, schema validation, byte/event caps and server-signed outcome support at ingest.
• Replay mask-by-default, prohibited-field blocking, separate reveal permission and independently configurable retention.
• AI tools inherit caller permission scope; captured page text is untrusted; high-impact mutations require confirmation.
• Billing, exports, replay reveals, privacy changes, tokens and AI actions are auditable.

Report a vulnerability

Use the support form, select Security report, and include a clear description, impact and reproduction. Do not access other users’ data, disrupt service, use social engineering or publicly disclose before a coordinated fix. We acknowledge credible reports promptly and will share remediation status.

Assurance roadmap

Threat modeling, dependency scanning, backup/restore drills, deletion drills and privacy fixture tests are release gates. An independent penetration test is required before Scale/enterprise launch. Compliance badges will only be displayed after the relevant audit is complete.