Security
Security and data protection
What PAD does today to protect project data, stated plainly. This page describes only what is in place, and says clearly what is not.
What is in place
Access by project role
Database rules (row level security) limit each project’s data to its members. Each member sees only the screens their project role allows.
Invite links that expire
An invite link is tied to a project role. PAD stores only a hash of the link’s token, never the token itself. A link expires after 7 days, works once for one person and can be revoked. A project can have at most 50 open invite links.
Sign in
Email and password with at least 10 characters, or Google sign in. SAML single sign-on is planned for organizations that require it. Invite pages are not cached and are opened without sending a referrer.
Export and deletion
Every user can export a copy of their data and delete their account and data from Profile, under YOUR DATA. Deletion asks you to sign in again, and a project you still own with other members must be transferred first.
Sign in with a code from your phone
On a computer you can sign in with a one time code from the PAD app on your phone. The phone asks for its screen lock, fingerprint or face before it shows a 6 digit code, you type your email and the code on the computer, and the code lasts 2 minutes and works once. Only a hash of the code is stored, three wrong codes end it, and attempts are limited per network address.
Where data is stored
Accounts, project data and files are stored with our database provider, Supabase. This page does not state a data region, because none is published.
Usage limits
Requests to the Assistant are limited per user, per minute and per day.
Error reports
Crash reports do not contain your name, email address or project data, and tokens are masked.
Browser protections
The web app is served over HTTPS with security headers such as X-Frame-Options and nosniff.
Encryption by our provider
Our database provider, Supabase, states that data is encrypted in transit with TLS and at rest with AES 256.
No advertising, no selling
We do not sell your data and we do not use it for advertising.
Service providers: Supabase, Vercel, Google, Resend, Expo, Sentry
Have a security question?
Send it through the contact form and we will reply by email.