← Back to Redtoolz

Security controls you can verify

This page documents safeguards currently present in the application. Hosting guarantees, certifications, backup policy, and SLA are not claimed here unless separately contracted.

Authentication and secrets

  • Passwords are stored as one-way hashes
  • Session cookies are HTTP-only and signed
  • Connected-account tokens are encrypted before database storage

Workspace isolation

  • Business data queries are scoped by organization
  • Owner, manager, approver, and viewer roles
  • Administrative actions require a platform admin session

Operational safeguards

  • Same-origin checks on sensitive mutations
  • Audit records for important account and admin changes
  • Feature and billing checks fail closed when unavailable

Use a unique password, restrict team roles to the minimum needed, and remove integrations that are no longer in use.