Security

How we protect your data — stated plainly, without certifications we don't have.

Encryption in transit: TLS on every connection (terminate at your reverse proxy / host).
API authentication: mutating API endpoints require an X-API-Key header when a key is configured
Input validation: every endpoint validates its inputs; malformed requests get a 400, never a stack trace.
Output escaping: user content is HTML-escaped before rendering, against stored cross-site scripting.
Secrets: all credentials come from environment variables; sample configs ship as .env.example with empty values.
Backups: the current production deploy runs on an ephemeral filesystem — the database is not automatically backed up nightly; backups are an operator procedure in the self-host install. the SQLite database file is backed up nightly in production deploys.
Least privilege: production runs as an unprivileged user; the database directory is not web-served.

We are not SOC 2 audited and make no HIPAA-certification claims (no such software certification exists).
Where the product touches regulated data, the relevant compliance gate (e.g., signed BAAs) is completed before real data is processed — not after.

Email don+foiaflow@lifeofmorr.com with "security" in the subject. We acknowledge within 2 business days.