Security
This page describes how sensemakingwith.ai secures your data and what we're doing to keep raising the bar. We try to be specific about what's true today rather than aspirational marketing — when we don't have a thing, we say so.
Data location and storage
All customer data lives on Cloudflare infrastructure:
- Cloudflare D1 — primary relational database (user accounts, framework content metadata, audit events). SQLite-backed, distributed globally with regional primaries.
- Cloudflare Durable Objects — per-room state for active collaboration sessions; persisted to D1 on every commit.
- Cloudflare KV — short-lived telemetry and rate-limit counters.
Cloudflare's data residency and security commitments are documented at cloudflare.com/trust-hub. Enterprise customers can request region-specific data placement — contact sales.
Encryption
- In transit: TLS 1.2+ for every connection (browser, MCP, WebSocket, internal service-to-service). HSTS enabled. HTTP redirects to HTTPS.
- At rest: Cloudflare D1, KV, and Durable Object storage are encrypted at rest by Cloudflare's platform. We don't currently apply application-layer encryption above that — your data in our database looks like ordinary rows.
Authentication
We support sign-in via:
- Google (live) — OAuth 2.0 / OpenID Connect
- Microsoft (in development) — OAuth 2.0 against Microsoft Identity Platform
- Magic link (in development) — one-time passcode delivered to your verified email address
- SAML SSO (planned for enterprise) — integrate with Okta, Azure AD, Google Workspace, etc.
Two-factor authentication is delegated to your sign-in provider. If you sign in via Google, you can enforce 2FA at the Google side; same with Microsoft. Magic-link is its own factor (something only the email-account owner can receive).
Subprocessors
Companies that process customer data on our behalf:
| Subprocessor | Purpose | Region |
|---|---|---|
| Cloudflare | Hosting, CDN, edge compute, database, key-value store | Global |
| Polar | Payments / merchant of record (paid plans only) | Global |
| Resend | Transactional email (magic-link, invites, billing receipts) | US/EU |
| OAuth providers | Sign-in (Google, Microsoft, etc. — only for users who choose them) | Per provider |
We add subprocessors only as required to operate the Service. Material additions are announced at least 30 days before going live.
Authorization model
We use a Policy Decision Point / Policy Enforcement Point (PDP/PEP) authorization spine — every state-changing request is checked against a Relationship-Based Access Control (ReBAC) model before executing. Read paths are getting the same treatment in upcoming releases. Audit logs record every authorization decision.
Audit logging
Significant events (creation, share grants, role changes, deletions) are logged with actor identity, timestamp, and resource. Free-tier audit retention is short; paid tiers retain longer; enterprise tier supports configurable retention windows up to indefinite. Audit log access is gated to managers and owners of the relevant tenancy.
Vulnerability disclosure
If you've found a security vulnerability, we'd like to hear about it. Please email security@sensemakingwith.ai with:
- A description of the issue and its impact
- Steps to reproduce
- Whether you've disclosed it elsewhere
We make commercially reasonable efforts to acknowledge and respond to reports, work in good faith on remediation, credit you (or keep you anonymous if you prefer) once an issue is fixed, and will not take legal action against good-faith research that doesn't degrade service for other users or access content beyond your own. We'll work with you on a reasonable coordinated-disclosure timeline.
We don't currently run a paid bug-bounty program. We're a small team and pay what we can in attribution and gratitude.
Compliance roadmap
We're not currently SOC 2 certified. Working toward it — it's the obvious next milestone for serving enterprise customers. We'd rather be honest about where we are than claim certifications we don't have.
For specific compliance asks (SOC 2 Type II, ISO 27001, HIPAA, FedRAMP, etc.), email security@sensemakingwith.ai — we'll tell you our current state and timeline.
Incident response
For data-breach notification, we follow the timelines required by GDPR (72 hours to authorities) and PIPEDA (as soon as practicable for material breaches). Affected users are notified by email. A public status page is in development; until it ships, watch cloudflarestatus.com for upstream issues.
Data retention and deletion
See our privacy policy for full retention details. Briefly: active accounts retain data while in use; soft-deleted files have a 30-day recovery window; account deletion removes data within 30 days (with limited retention for legal/financial compliance).
Contact
Security: security@sensemakingwith.ai · Privacy: privacy@sensemakingwith.ai · General: contact