Security

How we protect your data — stated plainly, without certifications we don't have.

Encryption in transit: TLS on every connection (terminate at your reverse proxy / host).
API authentication: every API endpoint requires your workspace API key; Slack requests are verified with Slack's HMAC signature against your own workspace's signing secret, and Slack endpoints refuse requests (503) when no secret is configured for the workspace.
Input validation: every endpoint validates its inputs; malformed requests get a 400, never a stack trace.
Output escaping: user content is HTML-escaped before rendering, against stored cross-site scripting.
Secrets: all credentials come from environment variables; sample configs ship as .env.example with empty values.
Backups: the hosted database runs on ephemeral storage today — it resets on redeploy and no nightly backup is performed yet; durable storage is on the roadmap. Self-hosted installs back up the single SQLite file on their own schedule.
Least privilege: production runs as an unprivileged user; the database directory is not web-served.

We are not SOC 2 audited and make no HIPAA-certification claims (no such software certification exists).
Where the product touches regulated data, the relevant compliance gate (e.g., signed BAAs) is completed before real data is processed — not after.

Email don+standuphq@lifeofmorr.com with "security" in the subject. We acknowledge within 2 business days.