Security
Team data stays with the team
Database-level isolation, passwordless sign-in, private storage and explicit publishing. Here is how it works.
- 01 —
Workspace isolation
Every row of customer data is tagged with its workspace, and the database itself (PostgreSQL Row-Level Security) refuses to return other workspaces' rows — even if a condition is missing in code. The isolation check runs on every service update.
- 02 —
Sign-in
No passwords: a one-time email link lives for 15 minutes. Optionally, a second factor (authenticator app) and one-time backup codes.
- 03 —
Sessions
Cookies with HttpOnly, Secure and SameSite flags; only token hashes are stored in the database. State-changing requests are accepted only from the app's origin.
- 04 —
Files
Datasets and images live in private storage and are served only through the API after an access check.
- 05 —
Compute
Notebook Python runs in the member's browser — data is not sent to third-party compute servers.
- 06 —
Public links
Off until you create one. Only what is marked public is visible; evidence, notebook cells and nodes are never shown. Revoke a link and the old one stops working immediately.
- 07 —
AI
AI tasks run only when you press the button. The model receives a text digest of the board (hypotheses, evidence, notes, column names) — never file contents.
- 08 —
Infrastructure
All traffic over HTTPS, a strict content security policy, rate limits, nightly backups and an audit log in every workspace.
- !
Found a vulnerability?
Write to security@asmtg.site