This page summarises controls that are in place today. It is maintained by Matsivo and is not an independent audit or certification. The Trust Center documents each area in depth.
Security overview
- One continuously maintained cloud application; security lives in the platform, not in per-customer configuration.
- Strict organization isolation enforced server-side on every read and write.
- Writes go through audited domain actions rather than direct table access from the browser.
- Database changes ship as versioned migrations with regression checks.
Responsible disclosure
If you believe you have found a vulnerability, contact security@matsivo.com. Please include enough detail to reproduce the issue and give us reasonable time to respond before public disclosure. Do not access data that is not yours, and do not run disruptive tests against production. A machine-readable policy is published at /.well-known/security.txt.
Security headers
- HTTPS everywhere with HTTP Strict Transport Security.
- Content Security Policy applied to every HTML response.
- Frame denial and cross-origin isolation headers to prevent clickjacking and leakage.
- A Permissions-Policy restricting browser capabilities the product does not use.
- X-Content-Type-Options: nosniff on all responses.
Encryption
- All traffic encrypted in transit with modern TLS.
- Data encrypted at rest by the managed database and storage layers.
- Secrets stay server-side; the browser never holds privileged credentials.
Authentication
- Email-verified accounts with neutral error messages to prevent account enumeration.
- Server-side throttling of authentication attempts.
- Time-based one-time password (TOTP) multi-factor authentication, enforceable per organization.
- Session idle and absolute lifetime limits requiring periodic re-authentication.
Audit logs
- Append-only security audit events for authentication and privileged actions.
- Domain actions record the acting user, organization and timestamp.
- Automatic purging of audit records once their retention horizon expires.
Business continuity
- Managed, automated database backups with point-in-time recovery capability.
- Infrastructure and schema defined as code so the environment can be rebuilt deterministically.
- Controlled, reviewed deployments with the ability to roll forward quickly.
Details: Business continuity in the Trust Center.