Security

What is true today

Every statement here traces to current code. Where Strataboard is not yet able to make a claim, it says so.

Current controls

  • Session cookies

    Authentication uses httpOnly session cookies with production-configured Secure and SameSite behavior.

  • Magic links

    Sign-in magic links are signed, single-use, and expire after 15 minutes.

  • Organization isolation

    Role-based access control is enforced per organization, and cross-org requests return a 404 rather than leaking existence.

  • Private boards

    Private boards are excluded from the public portal APIs and never served to anonymous visitors.

  • Encrypted credentials

    Integration credentials are encrypted at rest with Fernet symmetric encryption.

  • Rate limits

    Route-specific rate limits protect availability, with a safe fallback when a limit store is unavailable.

Not claimed today

Strataboard does not currently claim or hold:

  • SOC 2
  • SAML single sign-on
  • EU data residency
  • penetration testing
  • a bug bounty program