Skip to main content

Encryption & Security Practices

How the platform protects your data

Encryption & Security Practices

The platform implements multiple layers of security to protect your business data.

Transport Security

  • HTTPS — All traffic is encrypted with TLS 1.3
  • Secure Cookies — Session cookies use HttpOnly, Secure, and SameSite flags
  • HSTS — HTTP Strict Transport Security headers are set

Data at Rest

  • MongoDB Atlas Encryption — Database encrypted at rest using AES-256
  • Environment Variables — Sensitive configuration stored as env vars, never hardcoded

Application Security

  • Input Validation — All user inputs validated with Zod schemas
  • CSRF Protection — Cross-site request forgery prevention
  • Rate Limiting — API rate limits to prevent abuse
  • Webhook Verification — Svix signature verification on Clerk webhooks

Dependencies

Dependencies are regularly audited for known vulnerabilities. The platform uses well-maintained, actively developed libraries.