Security

Security, stated plainly.

We don't have a SOC 2 certificate to wave at you, so here's what we actually do — and what we don't claim.

What we do

Authentication on non-public endpoints: API keys or admin tokens guard everything that isn't designed to be public.
Encryption in transit: the service is deployed behind TLS (HTTPS) — we never recommend running it on plain HTTP in production.
Input validation: every endpoint validates and size-limits its inputs; errors are structured, never stack traces.
Structured logging: operational logs for reliability and incident response — no sensitive payloads in logs.
Fail-closed configuration: if an auth secret isn't configured, protected endpoints refuse traffic rather than opening up.
All /v1/* endpoints require a Bearer API key; the service fails closed when it's unset.
All configuration is environment-driven; no secrets are hardcoded.
Deploy behind TLS (HTTPS). Each customer's roster lives in its own tenant store — customer-confidential, and deleted within 30 days of cancellation: per-tenant deletion removes that workspace's rows and roster file without touching any other customer.
The hosted service runs as a single instance per deployment today; per-tenant file stores keep each customer's data separate, and multi-replica serving arrives with the shared-store upgrade.
Tenant API keys are stored only as SHA-256 hashes; a key is shown exactly once, when it is claimed or minted.

No SOC 2, ISO 27001, or other certifications — yet. We'll pursue them when customer demand justifies it, and say so here when we do.
No security practice is a guarantee. We describe controls, not outcomes.

Email don+offboardly@lifeofmorr.com with "security" in the subject. We'll acknowledge within 2 business days and keep you posted on the fix.