Security
What is true today
Every statement here traces to current code. Where Strataboard is not yet able to make a claim, it says so.
Current controls
Session cookies
Authentication uses httpOnly session cookies with production-configured Secure and SameSite behavior.
Magic links
Sign-in magic links are signed, single-use, and expire after 15 minutes.
Organization isolation
Role-based access control is enforced per organization, and cross-org requests return a 404 rather than leaking existence.
Private boards
Private boards are excluded from the public portal APIs and never served to anonymous visitors.
Encrypted credentials
Integration credentials are encrypted at rest with Fernet symmetric encryption.
Rate limits
Route-specific rate limits protect availability, with a safe fallback when a limit store is unavailable.
Not claimed today
Strataboard does not currently claim or hold:
- SOC 2
- SAML single sign-on
- EU data residency
- penetration testing
- a bug bounty program