API keys
- The full key is shown once, when you create it. We store only a masked form for display.
- Keys are independent, so you can revoke one without touching the others.
- Keep keys in a secret manager and out of client-side code.
Connected sessions
- Only import sessions for accounts you own or are authorized to operate.
- Each connected session runs on its own dedicated 1:1 mobile profile and is never shared between customers.
- You can remove a session at any time; we stop using it immediately.
Your account
- Passwords are stored as salted scrypt hashes. Sessions use signed, HTTP-only cookies.
- Payments are handled by Stripe; card details never touch our servers.
- All traffic to the dashboard and the API is encrypted in transit.
Reporting a vulnerability
Send details through the contact form with the topic Security. Please give us a reasonable time to fix the issue before disclosing it, and don’t access data that isn’t yours.