Isolation
Every row in the database carries an org_id. A single Prisma extension (forOrg(orgId)) auto-injects this filter on reads and writes for org-scoped models, so a missing scope is impossible by construction. An integration test suite (tests/integration/isolation.test.ts) actively tries to read and write other orgs' data and asserts every attempt fails.
Encryption
- In transit: HTTPS only, HSTS, and secure cookies for authenticated sessions.
- Browser hardening: production responses include a content security policy, clickjacking protection, strict referrer policy, permissions policy, and
nosniffheaders. - At rest: the managed database encrypts disks. Your bring-your-own email credentials are additionally encrypted with AES-256-GCM and a server-only key (
EMAIL_CREDENTIAL_KEY), and never returned to the client.
Payments
We never store card numbers, CVCs, or expiry dates. Hoursmith subscription billing redirects to Stripe Checkout / Customer Portal. Online invoice payments use Stripe Connect direct charges into your connected Stripe account. We store only Stripe identifiers, payment status, and webhook data needed to reconcile invoices.
Backups + restore
Production Postgres is a managed service (Neon, Supabase, or RDS depending on the deployment). Daily automated snapshots are retained for at least 7 days. We test a restore at least once per quarter against a throwaway database.
Logging + alerting
Server errors and unhandled rejections route to Sentry (when SENTRY_DSN is configured). Webhook handler failures and billing reconciliation drift trigger alerts.
Data export
You can export every row in your workspace as JSON from /settings at any time, including activity log and email log entries — see /privacy for the catalog.
Reporting an issue
If you think you've found a vulnerability, email hi@hoursmith.app. We respond within 72 hours and credit reporters with their permission.