Security

Project data (projects, comments, approvals and user records), logins, the emails we send and our logs are held with Amazon Web Services in Sydney. Every file you upload is stored on DigitalOcean in Sydney, and the image service that makes thumbnails and previews runs there too, answering through Cloudflare's network. The app's own static files (the code your browser loads, not your data) are served from Amazon CloudFront edge locations around the world. Card details go to Paddle, our payment provider, which may process data overseas. The card never reaches Propagio.

The app answers over HTTPS only. A plain HTTP request is redirected to HTTPS. The minimum is TLS 1.2 with the 2021 cipher policy. Browsers are told to use HTTPS for a year. Our API answers over HTTPS, and its uptime check is made over HTTPS.

Before a release of the app can go out, the packages our code depends on are checked against the public list of known faults. A high or critical fault stops the release unless it has been looked at and accepted in writing. Package signatures are checked before the server code is uploaded. We do not yet run a scanner over our own source code or our cloud settings.

Between 30 October and 3 November 2026 we reviewed the app's code, the website's code, our cloud accounts, our domain records and our email settings, and ran attack tests against the app's handlers. Every finding went on one register. The website's highest finding was fixed in code and published on 4 November 2026, and volume limits on the sign-up service went live on 3 November 2026. Other findings stay open on the register. Twenty-three earlier items were proven closed. The review was run in-house, not by an outside firm.

Our plan starts the clocks from the moment we first suspect a problem. It says how to stop the damage, how to keep the logs before they expire, how to decide whether a breach must be reported, and how to notify the Office of the Australian Information Commissioner and the people affected. It was last checked against our code on 30 October 2026. We also keep a written recovery plan and an operations runbook for every alarm.

Every database table can be restored to any point in the last 35 days, and the tables are protected against accidental deletion. Every night a copy of every uploaded file is made to Amazon S3 in Sydney. The copy adds files and does not remove them. Where a file has been replaced, the older version is dropped after ninety days. An alarm fires if the nightly copy does not run or hits an error.

We are alerted on API errors, database and function throttles, function errors, email bounces, payment failures, failed sign-ins, sign-up floods and web firewall blocks. Every change to our cloud account is written to an activity trail that covers every region, and its log files carry a check that shows if they were altered. The app, the API and the image service each have an uptime check with its own alarm.

Passwords must be at least 8 characters with upper and lower case, a number and a symbol. Two-step sign-in with an authenticator app can be turned on by project managers and management, and is not yet required. A web firewall sits in front of sign-in. A signed-in session lasts 60 minutes and can be refreshed for up to 5 days. We do not offer single sign-on today.

Paddle takes payments; your card never reaches us. Amazon Web Services holds logins, project data, the emails we send and our logs. DigitalOcean holds your uploaded files and runs the image service. Cloudflare carries requests for thumbnails and previews. Resend relays the join form on this website. Google Fonts serves this website's fonts and receives your IP address. There is no analytics script on this website or in the app. The app's AI helper only runs when a key is set, and none was set when we last checked, on 20 October 2026. Full details are in our Privacy Policy.

A project bought on its own is live for six months, and one funded by a plan for twelve. After that it can be archived free for six more months. The API access log is kept for 14 days and server function logs for 90 days. Billing records are kept for seven years. When a person's account is deleted, the login and the user record are deleted and their name becomes "Deleted user" in projects. A deleted project is removed eight days after the request, and management can take it back in those eight days; a copy can remain in the nightly backup after that.

Browsers are told to use HTTPS for two years, including subdomains. The page cannot be framed by another site. A content security policy limits where scripts and styles may load from. There is no analytics script.