All stored data is encrypted at rest. All network traffic is encrypted in transit. Sensitive credentials receive an additional application-layer encryption.
At rest
All data stored in our managed database is encrypted with AES-256 at the storage layer. This is the same standard used by AWS-backed and GCP-backed managed databases by default.
In transit
All network traffic between your browser and our application is encrypted with TLS 1.3. Our application servers do not accept unencrypted (HTTP) connections.
Application-layer encryption for credentials
Contractor tax IDs (SIN, SSN, EIN) receive an additional layer of encryption with Fernet (a standard authenticated-encryption scheme) before being written. This is defense-in-depth: a database breach alone would not expose these credentials.
We do not collect passwords
We never ask for the passwords to your business accounts, and we never ask for access to your systems or mailboxes. Everything we check is observed from outside.
More detail
See our Security Standards page for the technical specification.