Security

How we protect your data — stated plainly, without certifications we don't have.

Encryption in transit: TLS on every connection (terminate at your reverse proxy / host).
API authentication: API endpoints require a per-account X-API-Key header in hosted deployments (keys are stored only as SHA-256 hashes); Stripe webhooks verify Stripe's HMAC signature and fail closed when unconfigured.
Input validation: every endpoint validates its inputs; malformed requests get a 400, never a stack trace.
Output escaping: user content is HTML-escaped before rendering, against stored cross-site scripting.
Secrets: all credentials come from environment variables; sample configs ship as .env.example with empty values.
Backups: the SQLite database file is a single file the operator backs up; no automated backup schedule is claimed for the current deployment.
Least privilege: production runs as an unprivileged user; the database directory is not web-served.

We are not SOC 2 audited and make no HIPAA-certification claims (no such software certification exists).
Where the product touches regulated data, the relevant compliance gate (e.g., signed BAAs) is completed before real data is processed — not after.

Email don+permitpilot@lifeofmorr.com with "security" in the subject. We acknowledge within 2 business days.