Trust centre

Security should be understandable, verifiable, and built in.

We use layered controls, privacy-minded defaults, and auditable operations to protect the people and organisations that work with us.

Only DNS-verified domains appear in our official-domain list.

Our approach

Practical safeguards across the whole service

We collect only what a workflow needs, protect it in transit and at rest, and apply configured retention periods.

Verified accounts, role-based permissions, multifactor authentication, and immutable audit history protect operational access.

Health checks, maintenance controls, rate limits, backups, and monitored security surfaces reduce avoidable risk.

Editable content and operational settings keep a record of who changed what, including the previous and current state.

Treat messages or sign-in pages on other domains with caution. These domains have passed our DNS ownership check.

If you believe you found a security issue, tell us privately so we can investigate without putting other people at risk.

Describe the affected page or service and the impact you observed.
Include reproducible steps, but do not access, alter, or retain other people’s data.
Allow reasonable time for investigation before sharing details publicly.