We're in closed beta. Sign up for early access — founding pricing locks in at signup, for as long as your subscription stays active.
Security
Everything below is labelled with its version, review date and status. A draft is a draft: it has not been finalised or independently reviewed. These are self-descriptions, not audits or certifications.
Vulnerability disclosure policy
How to report a vulnerability and what to expect.
Final · version 1.0 · reviewed 2026-10-02 · Web page
security.txt
Machine-readable security contact and policy location.
Final · version RFC 9116 · reviewed 2026-10-02 · Plain text
Security whitepaper (web)
Architecture, encryption, backups, tenant isolation and more, with every statement labelled by evidence class. Draft: not yet independently fact-checked.
Draft · version 1.1.0 · reviewed 2026-10-15 · HTML document
Security whitepaper (PDF)
The same paper as a PDF download.
Draft · version 1.1.0 · reviewed 2026-10-15 · PDF download
Subprocessors
Third-party services we use. Under legal review; vendor agreements still being confirmed.
Draft · version 2026-10-30.1 · reviewed 2026-10-08 · Web page
Data Processing Agreement
Still being finalised with legal counsel and not yet published. Contact us to discuss your requirements.
On request · version none published · reviewed 2026-10-02 · Contact form
Incident history
Resolved incidents with timestamps and updates, on the status page.
Final · version live · reviewed 2026-10-02 · Web page
Security questionnaires and architecture review
Tell us what you need reviewed. A completed CAIQ-Lite self-assessment is in preparation and is not yet published.
On request · version n/a · reviewed 2026-10-02 · Contact form
Report a vulnerability
Private reports go to this address.
Final · version n/a · reviewed 2026-10-02 · Email
Time-based one-time codes (TOTP) as an extra login factor, independent of your password.
Your identity provider stays the source of truth for who can log in. Configure SAML or OIDC SSO yourself from your organization settings. SSO is included on Team and Enterprise.
SCIM 2.0 user and group provisioning on the Enterprise plan, covering a documented subset of the protocol: provision, look up, list, deactivate and reactivate users, and create groups and manage membership that maps to roles. Generate your SCIM token from your organization settings and connect your IdP yourself.
See every active session tied to your account and sign out of all of them remotely in one action. Revoked sessions are deny-listed and rejected, not left valid until they happen to expire.
SSO, SCIM, membership, and repository-governance changes are all written to your org’s audit log, with an export endpoint and an optional webhook to your own SIEM.
Owner, Admin, Manager, Member, Billing Admin, and Auditor roles, each scoped to a fine-grained permission set. Auditor is read-only — access to the audit log and organization data, without the ability to change anything.
Required approvals, CODEOWNERS enforcement, stale-approval dismissal, and required status checks gate the merge button per repository — configurable, not just documented.
Set merge and push-protection rules once and apply them across every targeted repository at once — targeted by visibility, an explicit repo list, or a name pattern — instead of configuring each repository by hand. Rulesets compose with a repository’s own settings on a strictest-wins basis. An admin can bypass a blocked merge only when their role is explicitly allowed to for every ruleset in play, and every bypass is written to your audit log.
The web app and API are served over HTTPS with HSTS; git is available over HTTPS or SSH. An independent check of our production TLS configuration is not yet published.
SSO client secrets are encrypted at rest (AES-256-GCM). SCIM tokens are stored as a one-way hash — irreversible, never plaintext or a decryptable ciphertext. Your SIEM webhook secret is a server-only field, stripped from every organization API response regardless of role.
Git repositories are stored on a dedicated storage volume. We have not yet verified at-rest encryption for that volume or for the database. LFS objects are stored in object storage that encrypts all data at rest by default.
Backups of your repositories and database run through restic, which cannot produce an unencrypted backup — encryption at rest is not an optional setting on that path. The database’s continuous point-in-time-recovery archive is additionally encrypted with our own key before it leaves the server.
Repositories, database, and Git LFS objects all back up hourly, plus continuous point-in-time recovery for the database. Not a manual, easy-to-forget process.
Repository and database backups are stored with a different provider from the servers that run the platform. Large-file backups are in a separate bucket with separate credentials, but with the same provider as the live large-file data, so a provider-wide incident could affect both.
Backup freshness is actively monitored — we’ve deliberately tested the alert path and confirmed it fires on a stale backup. A full restore drill (restore, integrity check, clone test) first passed on 2026-07-13 and was repeated on 2026-09-30 on the current infrastructure, both times with a small pre-launch dataset; restore time at production scale has not been measured.
Your code is never sold and never used to train UnityFreak's own AI models. It is scanned only as needed to run and secure the service (for example, malware scanning and automated safety checks on uploads). AI features (the PM assistant, AI-enhanced search, the content and portfolio assistants, and transcription of recorded calls and uploaded meeting audio today; code review when the community module opens) send only the content you submit to them to Google's Gemini API, never repository contents on their own. Every organization, every plan.
Request a complete export of your account data straight from your account settings — no support ticket required.
Consent for terms, privacy policy, marketing email, analytics and cookie preferences is recorded individually, not bundled into one blanket checkbox.
For organizations that need control over project conversations, not just the ability to have them.
Set a retention window for your organization’s project conversations. A scheduled job purges messages past that window automatically — not a manual, easy-to-forget cleanup task.
Place a hold — organization-wide, or scoped to a single project or person — that preserves messages through a snapshot before any edit or delete can proceed, independent of your retention window.
Export every governed conversation across your organization, including deleted messages — a message’s content and the fact that it was deleted are both preserved for legal and compliance review.
Route new messages to your own data-loss-prevention tooling via a signed, per-organization webhook. Your DLP tool can call back to redact a message; every redaction is written to your audit log.
Organization admins can remove messages from governed project conversations, even ones they’re not a participant in. Restrict project conversations to organization members only, or allow guests — your choice, per organization.
Third-party services we actually integrate with, and what each one is for.
| Subprocessor | Purpose |
|---|---|
| Stripe | Payment processing and subscription billing. |
| OVHcloud | Infrastructure hosting: the servers and storage volumes that run the platform. |
| Cloudflare | Content delivery, DDoS protection and TLS termination; object storage for LFS objects, uploads, exports and encrypted backups; email routing; and its CSAM Scanning Tool, which hashes images entering its cache and blocks URLs that match known illegal imagery. |
| PostHog | Product analytics, gated behind cookie consent. |
| LiveKit | Real-time audio/video infrastructure for in-app calls, audio rooms and live streams, including the recording (egress) of calls that participants record and the live audio feed used for captions. |
| Brevo | Transactional and (where you have opted in) marketing email, newsletters and digests; and receipt of email replies you send to task threads. |
| Google (Gemini API) | AI-assisted features: the PM assistant, AI-enhanced search, the content and portfolio assistants, and transcription of recorded calls and uploaded meeting audio (and code review when the community module opens). |
| Deepgram, Inc. | Speech-to-text for live captions in audio rooms and live streams when the host turns captions on, and for transcription of a live-stream recording when the host supplies its recording link on ending the stream. |
| Amazon Rekognition (Amazon Web Services, Inc.) | Automated moderation of user-uploaded images, including frames sampled from video and rendered document pages, to detect illegal and harmful content. |
| Sentry | Error and performance monitoring for the web app and API. |
Found a security issue? Email [email protected] with a description, reproduction steps, and any relevant logs or affected endpoints. Please don’t open a public issue, test against other users’ production data, or run automated scanners without coordinating with us first. We take every report seriously and will acknowledge it, but as a small, pre-launch team we don’t yet have a formal response-time SLA to publish.
Read the full disclosure policy or fetch the machine-readable security.txt.
Resolved incidents are published on our status page, with timestamps, affected systems and updates. A history with no entries means no incident has been recorded there. It is not proof that service was never interrupted: only the project-management journey is measured, and other incidents appear only when someone records them. Our customer-notification policy is still a draft, so we do not promise a notification deadline.
No independent audit, penetration test or certification has been completed. This is where each one stands.
A third-party penetration test is planned. No provider has been engaged and no date has been set.
A SOC 2 Type I assessment is planned. No provider has been engaged and no date has been set. We maintain an internal readiness checklist, which is not an audit report.
Status recorded 2026-10-02.
We track our controls against standard frameworks. Note: This table is a readiness self-assessment generated directly from our verified compliance data. It does not constitute an independent SOC 2 certification or report.
| Control Area | Status | Summary | Limitations / Scope | Last Reviewed |
|---|---|---|---|---|
| Security | Implemented | Sensitive secrets are encrypted at rest (AES-256-GCM) or irreversibly hashed. | Applies to specific secret fields (e.g., SSO client credentials) and hashed tokens. It is not blanket encryption of all customer data. | 2026-09-22 |
| Security | Partial | The web app and API are served over HTTPS with HSTS; independent verification of the production TLS configuration is not yet published. | HSTS is set in the application source. Production TLS termination is configured outside the source and has not been independently verified; deployment evidence is still required. | 2026-10-02 |
| Security | Implemented | Passwords are hashed using bcrypt with constant-time comparison to prevent timing attacks. | — | 2026-09-22 |
| Security | Partial | TOTP-based two-factor authentication is available. | The whiteboard relay now enforces the organization's two-factor and network policy at connect (Task 84-F3, fixed in source and tested); production deployment of the fix has not been verified. | 2026-10-15 |
| Security | Partial | Single Sign-On (SAML and OIDC) is supported with PKCE and signature verification. | Refresh of a valid SSO-created session is fixed in source and tested (Task 84-F5); other SSO carve-out behaviour was not re-reviewed, and production deployment of the fix has not been verified. | 2026-10-15 |
| Security | Implemented | SCIM 2.0 provisioning and deprovisioning is supported, including session and token revocation upon deprovisioning. | — | 2026-09-22 |
| Security | Partial | Role-Based Access Control implements granular organization and project-level permissions. | Custom role assignments contain escalation paths and bypasses (Task 85 F1-F8 defects). | 2026-09-22 |
| Security | Implemented | Account lockout and rate limiting protect against brute-force attacks. | — | 2026-09-22 |
| Security | Partial | Sessions can be globally revoked and are bound by a TTL. | Desktop sessions lack max-age/idle enforcement (Task 84-F10). | 2026-09-22 |
| Security | Partial | Authentication, configuration, and access events are recorded in an organization audit log. | Audit rows for custom-field, board and automation changes are fixed in source (Task 83 F3, F8); the full set of audited project mutations was not enumerated, and production deployment of the fix has not been verified. | 2026-10-15 |
| Security | Partial | Audit logs are retained and exported before archival. | Cursor pagination replaces offset pagination in audit-log pages and exports (Task 83 F7, fixed in source and tested); production deployment of the fix has not been verified. | 2026-10-15 |
| Security | Partial | Audit logs can be exported via CSV/JSON or streamed via webhooks. | Exhausted SIEM deliveries fail to notify organization owners (Task 83 F6). | 2026-09-22 |
| Security | Implemented | Dependency vulnerability scanning runs continuously in CI. | — | 2026-09-22 |
| Security | Implemented | Static Application Security Testing (SAST) is integrated into the build process. | — | 2026-09-22 |
| Security | Implemented | Source code is scanned for secrets prior to commit/merge. | — | 2026-09-22 |
| Security | Partial | Authorization logic undergoes code review, though gaps remain in systemic coverage. | A full, systematic authorization review across the entire codebase has not been completed. | 2026-09-22 |
| Security | Not Verified | Third-party penetration testing is planned. | Not yet commissioned. | 2026-09-22 |
| Security | Implemented | A vulnerability disclosure program is established and publicly available. | — | 2026-09-22 |
| Security | Partial | An incident response runbook exists; no customer-notification time commitment is defined and the notification drill has not been run. | The runbook defines severity levels, escalation and containment. No customer-notification SLA is defined, and the tabletop notification drill is a written script that has not been executed. | 2026-10-02 |
| Availability | Implemented | Automated, monitored, offsite backups are maintained for databases and repositories. | — | 2026-09-22 |
| Availability | Partial | A restore drill first passed on 2026-07-13 and was repeated on 2026-09-30 on the current infrastructure, both with a small pre-launch dataset; no later drill is on record. | The data restored is pre-launch scale, so restore time at production scale has not been measured. The quarterly repeat planned for October 2026 has not yet been recorded. | 2026-10-15 |
| Availability | Implemented | Backup freshness is actively monitored and alerted. | — | 2026-09-22 |
| Availability | Not Verified | High availability is not in place: the platform runs on a single OVHcloud server with no standby. A topology is documented as a plan. | Operates on a single OVHcloud server. Recovery means provisioning a replacement server and restoring from backup. | 2026-10-02 |
| Availability | Implemented | Recovery Time and Recovery Point Objectives are documented based on current data scales. | Current numbers are measured at pre-launch small-data scale and do not constitute a guaranteed timeline or promise that holds at 100x data scale. | 2026-09-22 |
| Availability | Partial | A public status page shows measured availability of the project-management journey; other areas are not yet measured. | Only the project-management journey is measured. Other product areas are not covered by the status page measurements. | 2026-10-02 |
| Availability | Not Verified | Formal uptime SLAs are pending commercial pilot terms. | Not built yet. | 2026-09-22 |
| Confidentiality | Partial | Data classification is handled informally in code. | No formal data-classification policy document exists. | 2026-09-22 |
| Confidentiality | Implemented | Sensitive fields are encrypted at rest. | — | 2026-09-22 |
| Confidentiality | Partial | Data access follows RBAC with least privilege principles. | Task 85 custom role logic has bypasses. | 2026-09-22 |
| Confidentiality | Partial | A subprocessor list is published and was reconciled with our hosting and storage providers on 2026-10-02; it is under legal review and vendor agreements are still being confirmed. | Earlier versions of the list were out of date (hosting had moved to OVHcloud and storage to Cloudflare R2). Per-vendor data processing agreement status is unconfirmed. | 2026-10-02 |
| Confidentiality | Not Verified | Data Processing Agreements are pending execution. | Not yet executed. | 2026-09-22 |
| Processing Integrity | Partial | Input validation is applied to API requests. | Not systematically audited across the whole codebase. | 2026-09-22 |
| Processing Integrity | Implemented | Critical operations like provisioning and archival are idempotent. | — | 2026-09-22 |
| Processing Integrity | Partial | Concurrency controls preserve referential integrity. | Not exhaustively audited; known TOCTOU races documented. | 2026-09-22 |
| Privacy | Implemented | Self-serve user data export is available. | — | 2026-09-22 |
| Privacy | Partial | Organization-level data export is supported. | Export bypasses specific project permission restrictions (Task 85 F7). | 2026-09-22 |
| Privacy | Partial | Account deletion anonymises profile data and revokes access; content you authored is not erased; backups keep deleted data until pruned. | Self-service and administrator-processed deletion now run the same steps (profile anonymised, sessions, API keys and linked sign-ins revoked, sign-in blocked); the administrator-path fix is in the source and awaits production deployment. Deletion is refused while a hold placed on that user is still in force. Content authored inside projects is not erased, and backup snapshots keep deleted data until they expire. | 2026-10-02 |
| Privacy | Implemented | Privacy policy and consent management record specific choices. | — | 2026-09-22 |
| Privacy | Not Verified | Data residency statements will be published. | Single-region hosting, no explicit customer-facing residency statement. | 2026-09-22 |
Tell us what you need reviewed — architecture, data flows, or a vendor security questionnaire — and we’ll walk you through it.