Security

Application security

• Cookie-based app sessions with signed secrets and secure session handling.
• Password hashing, email verification flows, optional TOTP, API keys hashed with SHA-256, and module-scoped API access.
• Role and permission enforcement for workspace and module surfaces.
• Tenant-scoped services and automated tenant-isolation checks.
• Audit logs for mutations and destructive action patterns.

Infrastructure security

• HTTPS is required for hosted services.
• Security headers help limit MIME sniffing, framing, referrer leakage, and browser feature access.
• Secrets are stored in environment variables or provider secret stores.
• Database access is separated by operational role and environment.

Data protection

• Tenant-scoped data models are registered and checked automatically.
• Money fields use Decimal precision enforcement.
• File storage uses signed upload links when enabled.
• Customer data export and deletion request flows exist in workspace settings.

Monitoring and response

• Application errors and service logs support incident investigation.
• Database and hosting telemetry support availability and performance monitoring.
• Incident response, breach response, backup restore, access control, and vendor management procedures are maintained internally.

Responsible disclosure

Report suspected vulnerabilities to security@sagasprint.com. Do not test against customer tenants or data without written permission.