Security practices.

Presently is built by a small studio. This page says what we actually do rather than implying an enterprise security programme we do not have. If your procurement needs something specific, ask — we would rather answer honestly now than fail a review later.

Workspace isolation

Every query for workspace data is scoped to your account’s membership on the server. A client viewing a share link cannot reach another workspace, and one customer’s workspace cannot reach another’s, because the authorisation runs in the API rather than being hidden in the interface.

Share links

• Tokens are long, random, and not guessable by enumeration.
• The client view is read-only by enforcement. There is no write endpoint a client can reach, so a modified request achieves nothing.
• Revoking a link takes effect immediately, and last-access time is recorded so you can see whether it was used.
• Share pages are excluded from search engine indexing.

A share link is a capability: anyone holding it can open it. Treat it like a door key, and revoke it when a client should no longer have access.

Authentication

Sign-in is Google OAuth or an email and password. Passwords are hashed with bcrypt and never stored in readable form. Sessions are carried in signed, HTTP-only cookies. If you sign in with Google, your password security is Google’s — which is a good place for it to be.

Data in transit and at rest

Everything is served over TLS. The database and file storage are managed services encrypted at rest by the provider. Backups are the provider’s managed, point-in-time backups.

Payments

Paddle is the merchant of record. Card details are entered into Paddle’s checkout and never reach our servers, database or logs. Billing webhooks are verified by signature before we act on them.

Application practice

• Secrets live in environment variables, never in source control.
• Dependencies are pinned, and advisories on our stack are monitored.
• Public endpoints — contact form, share resolution — are rate limited.
• Access to production is limited to the people who operate the service, with multi-factor authentication required.

What we do not claim

We are not SOC 2 or ISO 27001 certified, we do not run a bug bounty programme, and we do not have a 24/7 on-call rotation. If any of those are hard requirements for you, Presently is probably not the right tool yet, and we would rather say so.

Reporting a vulnerability

Email security@ayuvam.com with enough detail to reproduce the issue. We acknowledge within three working days and keep you updated until it is fixed.

Please give us reasonable time before disclosing publicly, do not access or modify data that is not yours, and do not run denial-of-service or automated scanning against production. We will not pursue legal action against researchers who follow that.

If something goes wrong

If a breach affects your data we will tell you without undue delay and within 72 hours of becoming aware, say what happened and what we are doing, and support any notification you have to make.

See also the privacy policy and the subprocessor list.