Security, privacy and reliability

The app and API are only served over HTTPS (TLS). Browsers are told to always use HTTPS (HSTS).

Google Cloud encrypts our database and file storage at rest (AES-256). Access tokens for connected tools such as Asana and ClickUp are also encrypted by us (AES-256-GCM).

Every request is checked on our servers against the organization of the signed-in user. Another organization’s records behave as if they do not exist. Database security rules apply the same separation, and automated tests check it.

Admin, editor and viewer roles are enforced on our servers, not only hidden in the screen.

Anyone can turn on two-step verification with an authenticator app. Admins can require it for the whole workspace, with a grace period.

Admins can set an idle timeout and a maximum session length. Deactivated or removed users lose API access within about a minute.

Not available yet. Today people sign in with email and password, Google or Microsoft, optionally with two-step verification.

Not available yet. Admins invite and remove users in the app.

Changes, sign-ins and security settings are recorded in an activity log that users cannot edit. It is kept for 12 months by default, can be exported, and has a tamper check. Enterprise adds longer retention, full-history export and streaming to your security tools (SIEM).

The database is exported every day to a separate storage bucket. A written restore procedure exists.

A restore-drill script and checklist are ready. We will publish the date of the first completed drill here.

We follow a written incident response plan with severity levels and roles. If an incident affects personal data you are responsible for, we tell you without undue delay so you can meet your own legal deadlines.

Report security issues privately to security@expiryedge.com. We acknowledge reports within 2 business days and do not take action against good-faith research.

Every code change runs automated tests and a scan for leaked secrets. Dependency updates are proposed automatically.

Uploaded files are checked by type, file name, size and content. Programs, scripts and web pages are refused. Antivirus scanning of uploads is planned.

One setting switches off analytics, session recording and marketing messages inside the app for the whole workspace. The in-app AI assistant is off by default. On by default for the Enterprise plan.

Admins can set how long records and activity are kept and place legal holds that stop deletion. (Exporting all of the organization’s data is available to admins on every plan.)