Current product controls
Security patterns built into the product
These controls describe the application today. Contact us for formal compliance documents, penetration-test information, or procurement questions.
Tenant-aware architecture
Multi-tenant routes, APIs, and data access patterns are designed around workspace boundaries.
Roles and permissions
Plan-supported roles and permissions control access to feedback, roadmaps, support, and settings.
Feature access controls
Feature gates restrict advanced capabilities, integrations, AI credits, and workspace controls by plan.
Authenticated administration
Workspace management uses authenticated admin routes, verified users, and session-based access controls.
Public API boundaries
Public widget flows are separated from administrative APIs and do not require admin access.
Managed infrastructure
Domains, uploaded files, storage, and generated configuration are handled through dedicated services.
Preparing for a vendor review
Share the exact setup your team plans to use so answers can be mapped to your plan, domains, integrations, and AI usage.
- Workspace access model and admin roles
- Data retention and export expectations
- Custom domain requirements
- Integration access and permissions
- AI feature usage and credit controls
- Security questionnaire requirements
Responsible reporting
Found a security concern?
Send the affected workspace, reproduction steps, and potential impact. We review reports directly and coordinate remediation based on severity.
Contact security