Security
Your records, locked down.
And every change on the record.
Quality records are evidence. We treat them that way.
Zero Trust sign-in
Cloudflare Access single sign-on. The API checks every token’s signature, audience, issuer and expiry itself.
Organization-scoped data
Every record belongs to an organization; every query is limited to it.
Keys stored hashed
API keys are shown once and stored only as peppered HMAC hashes. Integration keys reach the intake API and nothing else.
Signed webhooks
HMAC-SHA256 over timestamp and body, with a five-minute replay window and delivery IDs.
Audit trail everywhere
Old value → new value, who and when, on every record type.
Abuse limits
Rate limits per organization, per IP and per integration, plus monthly submission quotas.
Roles
Owner, admin, manager, member and viewer, plus a support-team role for the Service Desk.
Hardened edge
Content Security Policy, frame blocking, no-store on API responses, upload type and size limits.
Your data, your call
Ask us to export or delete your data at any time.
Hosted on Cloudflare (Workers, D1, R2). See data deletion.
See QMS on your own process.
Twenty minutes, your use case.