Where your data lives
- Servers in the European Union, at netcup GmbH (Germany).
- Every workspace has its own database and its own database user, so one workspace cannot read another's data.
- Daily backups with a 14-day, 8-week and 6-month rotation, encrypted and stored with a different provider.
Access to your workspace
- Two-factor sign-in with an authenticator app for every user.
- Roles and permissions down to individual fields, boards and actions.
- Optional sign-in restrictions by IP address.
- An audit log of who changed what, and a trash bin to restore deleted records.
- Sessions are bound to your workspace's address and use secure, HTTP-only cookies.
Application and infrastructure
- TLS on every connection, HSTS on all our domains.
- Passwords are stored only as salted hashes.
- Protection against CSRF and rate limits on sign-in and sign-up.
- Server access only with SSH keys; firewalled hosts with automatic security updates.
- Secrets live outside the code repository; customer data is never copied to development or test systems.
Privacy and compliance
- A Data Processing Agreement with Standard Contractual Clauses for every customer.
- A public list of sub-processors with advance notice of changes.
- No selling of data, no advertising trackers on our site.
Report a vulnerability
If you believe you have found a security issue, email support@sellsquatch.com with the subject "Security" and enough detail to reproduce it. Please do not access other customers' data or degrade the service while testing. We will reply within three business days and keep you updated until it is fixed.