Security
The browser never touches the database.
Every request is verified server-side at a single gateway before any data is read or written. Identity comes from a verified token, never from client input.
- ✓Sign-in secured by Auth0; every token verified server-side against the tenant keys
- ✓Role-based access with four roles and per-workspace isolation
- ✓Secrets and database keys stay server-side, never in the browser
- ✓Rate limiting on sensitive actions, and sign-out clears cached tokens and local data
- ✓Encryption in transit and at rest, with an enforced Content-Security-Policy and HSTS
Built on infrastructure from Auth0, Cloudflare, and Supabase, each of which maintains SOC 2 compliance for its platform.
Browser
Your workspace app
Sends a verified token with every request
Gateway
Cloudflare Worker
Verifies the token and enforces your role before any action
Database
Supabase Postgres
Reached only through the gateway; row-level security stays on as defense-in-depth
The smart productivity app for teams that bill by the hour.
One fast, focused workspace for time, goals, reporting, and your whole team. Launching soon — be first in line.