Authentication
Firebase Email/Password authentication, persistent sessions and protected application routes.
Security
Practical safeguards, described without inflated claims.
Security is built into authentication, API boundaries, token handling and data rules.
OAuth security
Signed, expiring state values and server-side code exchange protect social connection flows.
Token handling
Provider tokens are encrypted before Firestore storage and are never returned to browser clients.
Data access
Firestore rules deny by default and scope supported records to authenticated users or workspace membership.
Secrets
Admin credentials, encryption keys and provider secrets remain server-only environment variables.
Infrastructure
The application runs on Vercel and uses Firebase services currently configured for the project.
This page does not claim independent certifications or audits that have not been completed.