Security
Security by architecture, described honestly
These are the controls actually built into the product — and an equally clear statement of what we don't have yet.
Architecture controls
Enforced server-side, on every request — not settings that can be toggled off in a UI.
Password hashing with argon2id
Passwords are hashed with argon2id. We never store or log plaintext credentials.
Hashed tokens
Personal access tokens and session tokens are stored hashed; a leaked database dump does not yield usable credentials.
Envelope encryption for secrets
Vault values are encrypted with AES-256-GCM under data keys wrapped by a cloud KMS master key. Plaintext exists only inside the vault package's decrypt paths.
Role-based access control
Owner, Administrator, Developer, Reviewer, and Viewer roles are enforced server-side on every action — the UI reflects permissions but never enforces them alone.
Tenant isolation
Workspaces are the tenancy boundary. Every query is scoped to the workspace; cross-tenant access is a server-side impossibility, not a UI convention.
Signed webhooks
Outbound webhooks are signed so receivers can verify payloads. Inbound billing webhooks are verified and processed idempotently.
Audit logs
Security-relevant events — access, reveals, role changes, merges — are recorded with actor and timestamp. Retention scales with plan.
Rate limiting
Authentication and sensitive endpoints are rate limited to blunt brute-force attempts.
Content Security Policy
The web app ships a strict CSP: no external scripts, fonts, or images. What you load is what we built.
Responsible disclosure
Found a vulnerability? Please report it privately to security@keelson.example rather than opening a public issue. We’ll acknowledge your report, keep you informed as we fix it, and credit you if you’d like.
Certifications: none yet
We do not currently hold SOC 2, ISO 27001, or any other certification, and we won’t imply otherwise with badge walls. We maintain a SOC 2 readiness roadmap — the controls above are designed with an eventual audit in mind — and this page will state plainly when that changes. If your compliance requirements are strict today, self-hosting under AGPL puts every control in your own hands.