Security

Every workspace is fully isolated. All data access is scoped to your account's membership — there is no code path that reads another workspace's data.

Passwords are hashed, never stored in plain text. Sessions are managed server-side and can be revoked at any time by signing out.

Your plan can only ever be changed by a cryptographically verified webhook from our payment processor, Paddle — never by a request from the browser. We never see or store your card details.

Data is encrypted in transit (HTTPS/TLS). Passwords are hashed at rest; production deployments should also encrypt the database at rest via the hosting provider.

If you believe you've found a security issue, please contact us at outrunv1privacy@outlook.com before disclosing it publicly.