Security Overview

Our approach

Security is built into how we design and run Textent. We follow the principle of least privilege, isolate tenant data, and aim to limit the data we collect to what the Service needs. This overview summarizes our main practices; it is not exhaustive, and our controls evolve over time.

Infrastructure and hosting

The Service runs on hardened infrastructure hosted in the European Union. Application servers and the primary database operate in isolated environments, and access to production systems is restricted to authorized personnel and protected by strong authentication.

Data protection

• Encryption: data is encrypted in transit using TLS, and sensitive data is encrypted at rest.
• Tenant isolation: each account data is logically separated, and every request is scoped to the authenticated account so that data cannot leak across tenants.
• Credential security: passwords are stored only as salted hashes, and access tokens for connected accounts are encrypted.
• Backups: we take regular backups of critical data to support recovery.

Access control

Access to production systems follows least privilege and is limited to authorized personnel using strong authentication. Internal access is logged, and we review access periodically.

Application security

We validate and sanitize input, enforce authentication and authorization on protected endpoints, and apply security headers and rate limiting.

Secure development

We follow secure development practices, review code changes before release, keep dependencies current, and test changes before they reach production.

Monitoring and incident response

We log and monitor the Service for errors and suspicious activity. We maintain an incident response process covering detection, triage, containment, remediation, and post-incident review, and we notify affected users where required by law.

Business continuity

We take regular backups of critical data and maintain recovery procedures designed to restore the Service in the event of a disruption.

Vendor management

We assess the providers we rely on for appropriate security and data protection, and we bind them to obligations consistent with our own.

Reporting a vulnerability

If you believe you have found a security issue, please report it to [email protected]. We appreciate responsible disclosure and will work with you to resolve verified issues. See our Vulnerability Disclosure Policy for how we handle reports.