Security

Accounts and sessions

• Passwords are hashed with bcrypt; we never store them in plain text.
• Sessions use a single HttpOnly, SameSite=Lax cookie that is marked Secure in production and expires after 14 days.
• Changing your password, or choosing “Sign out everywhere”, revokes your other sessions immediately.
• Every state-changing request must carry a custom header that browsers will not send cross-site, as a guard against cross-site request forgery (CSRF).
• Sign-in and registration are rate-limited, and the whole API has a per-client rate limit.

Access control and tenant isolation

• Roles and permissions are enforced by the server on every request. The interface hides controls you cannot use, but it is not what protects your data.
• Every workspace query is scoped to the workspace you are a member of, and automated tests check that one workspace cannot read or change another’s data.
• Sensitive actions — sign-ins, role changes, invitations, exports, deletions, opt-out changes and more — are written to an audit log. Owners and Admins can review the workspace audit log in Settings.

Support access

Platform administrators can see summary information needed to operate the service. To open a workspace’s content for support, an administrator must take an explicit “join” action. That action adds them as a visible member, sends a notification to the workspace and is recorded in the audit log. Every platform administration action is audited.

Protecting connected accounts and data

• Social platform access tokens and private store credentials (Shopify, WooCommerce, WordPress) are encrypted at rest with AES-256-GCM. In production the service refuses to start without a dedicated encryption key.
• Store credentials are tested before saving, never returned by the API, used only over HTTPS and pinned to the website they were saved for.
• Invitation tokens and the private links bookers use to manage an appointment are stored only as hashes.
• OAuth connections use single-use, time-limited state values bound to your workspace.
• Disconnecting an account deletes its stored tokens.
• Data exports never include passwords, access tokens or other secrets.
• Inbound webhooks (Stripe, Meta Lead Ads and automation webhooks) are verified with signatures before they are processed.

Safe website scanning and uploads

• The website scanner only fetches public addresses. It resolves each host name, refuses loopback, private, link-local (including cloud metadata) and other reserved networks, connects only to the address it validated (protecting against DNS rebinding), and re-checks every redirect, with limits on pages, response size and time.
• Uploaded files are identified by their actual content (magic bytes), never by the file name or the type the browser claims. Only supported image, video and PDF formats are accepted, within a size limit.

Web application hardening

• Security headers are set with Helmet, including a Content Security Policy in production that restricts scripts to our own origin and prevents the app from being framed by other sites. Published landing pages are served with a strict policy that allows no scripts at all.
• Request bodies are size-limited and validated against schemas before they are processed.
• The public demo and contact forms, capture forms and booking pages are rate-limited and include spam protection. Demo and contact requests store only a salted hash of the sender’s IP address.
• Server logs redact passwords, tokens, cookies and keys, and automated email bodies are never written to logs.

Backups

The service includes a backup tool that creates timestamped database backups and keeps the newest 14 by default, and a restore tool that refuses to overwrite the live database by accident. How often backups run and where copies are stored is decided by the operator: [BACKUP SCHEDULE].

What we do not claim

Grow92 AI does not currently hold SOC 2, ISO 27001 or any other security certification, and we do not publish penetration-test results or offer an uptime guarantee. If and when that changes, we will update this page with the details.

Reporting a vulnerability

If you believe you have found a security issue in Grow92 AI, please tell us through the contact page and choose the Security topic. Include enough detail for us to reproduce the problem, and please do not access other people’s data, disrupt the service or make the issue public before we have had a chance to fix it.

We will acknowledge genuine reports, keep you informed while we investigate, and credit you if you would like us to.