Security

1. Data isolation

Each customer's data is kept apart from every other's, and access is checked on every request.

2. Signing in

• People sign in with a one-time code sent to their email address, or through single sign-on where their team has it. There is no password.
• A second factor is optional.
• Single sign-on will be included with the Business Plus plan.

3. Encryption

Data is encrypted in transit and at rest.

4. Audit log

Team accounts have an audit log.

5. Where data is held

The application and its database are hosted in London. Every provider the service runs on is named in the privacy notice, with where it processes data.

6. Backups

Customer data is backed up.

7. Content

Content is drafted with the help of AI and reviewed by an application security professional before release.

8. Reporting a vulnerability

Our responsible disclosure policy sets out how to report a vulnerability and what is in scope. Its address and how to reach us are also published at /.well-known/security.txt, following RFC 9116.

9. Incidents and breach notification

How we tell a Business customer about a personal data breach that affects its data is set out in section 6 of the data processing agreement.

10. Insurance

We hold professional indemnity, public liability and employers' liability insurance.

11. Documents

The data processing agreement is published in full at /dpa. Our security controls page lists controls this product was reviewed against, each citing the OWASP Application Security Verification Standard requirement it rests on.