← Back to home
Security
How we protect your data and accounts.
Infrastructure
Hosted on Cloudflare Workers + Postgres. All data encrypted in transit (TLS 1.2+) and at rest.
Access control
Row-level security enforced at the database for every user-facing table. Role-based access (owner, admin, editor, viewer) per workspace.
Authentication
Email + password with leaked-password protection (HIBP) and Google OAuth. Sessions are token-based and revocable.
Secrets
Third-party API tokens are encrypted at rest and only accessible by privileged server functions.
Webhooks
Payment webhooks verified by HMAC signature with constant-time comparison before any state mutation.
Reporting vulnerabilities
Email security@cciacontent.com. We respond within 2 business days.