Legal and trust
Security
Security is designed around tenant isolation, stable evidence and controlled public scan surfaces.
Last updated August 16, 2026Application controls
Passwords are adaptively hashed, sessions use secure HTTP-only cookies, mutations enforce same-origin requests and sensitive routes are rate limited. Role and tenant checks are applied in server-side queries.
Data protection
Evidence objects are private, storage quotas are enforced transactionally and downloads require workspace authentication. Production storage uses encryption at rest, lifecycle policies and backups.
Operational resilience
Task generation and cleanup run through authenticated schedulers. Health checks cover database and storage connectivity. Structured error events support monitoring without returning internal failures to users.
Reporting
Report suspected vulnerabilities or abusive QR destinations through the abuse form. Do not access other customers' data or perform destructive testing without written authorization.