Encrypted on the way
Every page and API call goes over HTTPS, and browsers are told to use nothing else.
Security
How we look after your data.
What we do to keep it safe, where it lives, and how to tell us if you find a problem.
What protects it
Your status file can be sealed
A sealed feed is encrypted with AES-256-GCM before it's published. Only your board's server and your own passphrase can open it, and only a few public counts stay readable.
Keys are stored as hashes
Workspace API keys are shown once, when you make them, and only a hash is kept. A revoked key stops working straight away.
Roles are checked on the server
Owner, Team and Viewer decide who can approve, pause or manage people, and the server checks every action, not just the page.
An audit log
Approvals, pauses and role changes are recorded with who did it and when. On hosted workspaces, so are sign-ins and API keys being made or revoked.
No card numbers
Stripe runs the checkout. We never see or store your full card number.
Strict browser rules
Pages send a content security policy and other headers that stop them being framed by other sites, and limit where scripts can come from.
Where it's hosted, and who else handles it
Some of these companies keep data outside Australia, mostly in the United States. We don't sell your information, and we don't share it for advertising.
| Company | What it does for us | Where |
|---|---|---|
| Vercel | Hosts the site and runs its server code. | United States and other regions |
| xAI (Grok) | Builds and publishes the site, and loads a small script on each page. | United States |
| Neon | The database for accounts, members, decisions and the audit log, set up by our host. | The region our host chose for it |
| Stripe | Takes payments and runs the checkout. | United States and other regions |
| Sign-in for team members on our own board, through Grok's sign-in. | United States and other regions | |
| Resend | Sends sign-in links and alert emails, once it's switched on. It isn't yet. | United States |
If you connect them yourself, Slack, Discord, Telegram, ntfy or an email service will carry your alerts, and an analytics or newsletter provider gets what our Privacy page says.
Found a problem?
Email support@barncleuth.com with "Security" in the subject. Tell us what you found and how to see it. Please give us a chance to fix it before you tell anyone else, and don't access other people's data to prove it. We'll reply as soon as we can. Our security.txt has the same details.