No online service can guarantee absolute security. This page describes controls currently built into PermitLoom; it is not an independent certification, audit report, or uptime guarantee.
Identity
Account protection
Email verification is required before a first workspace is created. Password recovery uses a time-limited email code, and users can review and revoke active sessions.
Authorization
Workspace boundaries
Protected workspace requests are authorized against the signed-in user and active workspace. Owner, admin, and member roles restrict general workspace changes, team administration, billing, and exports; members can update only tasks assigned to them and related proof.
Records and files
Private by default
Workspace documents use private object storage and authenticated, workspace-scoped delivery. External uploads are bounded by size and type, with file-signature checks for supported formats.
Operations
Reliability and recovery
Revision checks detect conflicting workspace saves. Production health is checked every 15 minutes, and recovery tooling verifies encrypted backup bundles before they are accepted.
Identity and access controls
- Unverified accounts cannot read or create a workspace. Verification and password recovery codes are sent to the account email address.
- Signed-in users can review active sessions, sign out one device, or revoke every other session from account settings.
- Workspace access is checked on the server against current membership and role. Members can update assigned tasks and related proof, while general workspace and administrative changes remain restricted.
- Key team, sharing, document, export, and deletion actions are recorded in workspace activity history for traceability.
Documents and controlled sharing
Private workspace files are read through authenticated routes rather than open object URLs. Evidence-request uploads have bounded size and format rules; supported PDFs, images, and text files are checked to ensure their contents match the declared file type. This is a file validation control, not an antivirus service.
Owners can create read-only report snapshots with a fixed scope and expiration, revoke them, and optionally require a six-digit viewer passcode. Without a passcode, anyone who has the link can view the snapshot until it expires or is revoked. Repeated incorrect passcodes trigger a temporary lockout. Invitation, evidence-request, calendar, and report secrets are stored as hashes rather than reusable plain-text tokens.
Browser and transport safeguards
Production traffic uses HTTPS with HTTP Strict Transport Security. PermitLoom also sends a nonce-based Content Security Policy, denies framing, disables content-type sniffing, limits referrer information, and disables browser capabilities the application does not need. Private API responses use no-store controls and are excluded from search indexing.
Reliability and recovery
Automated production checks are scheduled every 15 minutes and cover the public application, database connection, migration integrity, scheduled jobs, security headers, billing configuration, and—when paid billing is enabled—provider readiness. Release checks include automated tests, linting, type checks, and a production build.
Recovery tooling packages the database and private files into authenticated AES-256-GCM encrypted backup bundles in a separate private store. SHA-256 checks verify the bundle before it is accepted and again during an isolated restore. Backup and recovery procedures are operational safeguards, not customer-facing recovery-time guarantees.
Infrastructure and data handling
PermitLoom uses Neon for database and authentication services, Vercel for application hosting and private file storage, Resend for transactional email, and Paddle for paid-plan billing where billing is enabled. The Privacy Policy explains what these providers process and how data is retained and deleted.
Your part in keeping work secure
- Use a unique password and keep verification codes private.
- Remove former teammates promptly and give each person the least access they need.
- Share recipient links and report passcodes through separate trusted channels when practical.
- Upload only records your organization is authorized to store and avoid unnecessary sensitive personal information.
Report a security concern
Report suspected vulnerabilities privately to support@permitloom.com. Include the affected URL, observed impact, and safe reproduction steps. Do not email passwords, verification codes, or private documents, and do not test against accounts, workspaces, or files you do not own. PermitLoom does not currently operate a paid bug-bounty program.
For an account-access concern, use the same address with “Account security” in the subject line. For general help, visit Support.