Locked down, from sign-in to database.
How we protect your account, your leads and your payments. Click any one to see how it works.
Passkeys
Windows Hello, Face ID or Touch ID. A passkey only works on our real site, so a look-alike page can’t use it.
Passkeys
Each passkey is made for our real site and works nowhere else. Every sign-in needs your face, fingerprint or PIN, and each challenge works once, for 5 minutes.
Device keys
A trusted device proves it holds its own key (ECDSA P-256), which can’t be copied off it.
Device keys
Remembering a device makes a key pair inside your browser. The private half can sign but can’t be read, so skipping the code means proving the key, not showing a cookie.
Sign-in codes, done properly
Hashed with a secret key only our servers hold (HMAC-SHA256), compared in constant time, and dead after five wrong tries.
Sign-in codes, done properly
A code is kept only as a keyed hash. Checking it takes the same time whether the first digit or the last is wrong, so timing gives nothing away.
The second step, in the database
Until it’s done, the database refuses your data, even with the right password.
The second step, in the database
Every table carries a rule that asks first whether this session finished its second step: a code, a passkey or a trusted device. Until it has, the database refuses.
Database guardrails
The database refuses to switch off row-level security, and every privileged function pins its search path. A change that breaks either fails the build.
Database guardrails
A trigger in the database refuses any change that would switch row-level security off, and every privileged function runs with a pinned search path, so nothing can slip in front of it.
Sealed provider keys
Your Twilio, Telnyx and SignalHouse keys and your Google Calendar connection are encrypted with AES-256-GCM.
Sealed provider keys
Every seal gets a fresh random nonce, and the key that opens it lives with our servers, never beside the data. A sealed key changed by a single bit won’t open.
Signed edge
Our API trusts a visitor’s address only when our edge has signed it, so nobody can fake one to slip past limits or blocks.
Signed edge
Our edge signs every request it passes to our API with a secret only it and we hold. Without a valid signature, the visitor’s claimed address is thrown away.
Hash-pinned scripts
Our pages run only scripts we’ve approved, each matched by its hash, and any blocked attempt is reported to us.
Hash-pinned scripts
Our content policy names every script that may run by its SHA-256 hash. Anything else, even code built from text, is refused before it starts.
Checked before every release
Automated security checks run before anything goes live, and stop the release if one fails.
Checked before every release
Seven checks run on every build: headers, scripts, secrets, every database change, and no queries in the live site’s code.
Device fingerprinting
We recognize browsers you’ve signed in from before and catch fake reviews on your website. Only a hash leaves the browser.
Device fingerprinting
A hash of what stays the same about a browser tells one you’ve used from a new one. It’s a signal only: it never lets anyone skip a step.
Number matching
A new device for our team can be approved from one already signed in, by matching a number shown on both.
Number matching
The new device shows a number; it’s typed on a device that’s already signed in. A wrong number or a deny signs the new device out, and requests expire in 2 minutes.
Breached passwords blocked
Every new password is checked against passwords leaked in real data breaches (Have I Been Pwned). Only 5 characters of its hash leave your browser.
Breached passwords blocked
Your browser hashes the password (SHA-1) and sends only its first 5 characters. Every leaked hash that starts with them comes back, mixed with decoys, and the match is made on your device.