Security

Annot8 uses layered technical and organizational safeguards appropriate to a multi-tenant feedback platform. This page describes current product controls without claiming a certification or guaranteeing that incidents are impossible.

• TLS-encrypted transport and secure-origin requirements for production service URLs
• Managed Clerk authentication, session verification, workspace roles, and server-side tenant authorization
• Explicit domain/environment allowlists and short-lived origin-validated tokens for public widget writes
• Verified Clerk and Polar webhook signatures and idempotent billing-event processing
• AES-256-GCM application-layer encryption for newly stored integration credentials, with authenticated key rotation
• Browser redaction of URL credentials, query strings, and fragments for captured diagnostic/Analytics URLs
• Consent-gated Analytics and scheduled deletion of aged Analytics records; plan history limits do not automatically delete feedback content
• Upload size/type limits, workspace-bound attachment checks, iframe sandboxing, and restricted browser permissions; issued file URLs must be treated as bearer links and kept private
• Dependency pinning, production software-composition audits, secret-pattern checks, linting, type checking, and production builds
• Account export/deletion, project/workspace cascade deletion, and short-lived widget-session cleanup

• Require strong authentication and promptly remove people who no longer need access.
• Use least-privilege workspace roles and third-party integration tokens.
• Restrict allowed domains and do not expose secret keys, tokens, or webhook URLs in public content.
• Configure consent, recording notices, retention, AI, Analytics, and public portals for the customer’s audience and jurisdiction.
• Avoid capturing sensitive fields/pages and promptly delete data that is no longer needed.
• Report suspected compromise and rotate affected credentials immediately.

Email security@annot8.app with the affected URL/component, reproduction steps, impact, and safe supporting evidence. Do not access data beyond what is necessary, disrupt service, use social engineering, degrade availability, publish secrets/personal data, or publicly disclose an unresolved issue. We will acknowledge a good-faith report, investigate, and coordinate remediation/disclosure where practicable.

The machine-readable contact is available at /.well-known/security.txt. Security incidents involving customer data should also identify the affected workspace and a trusted callback contact.

Annot8 does not currently hold or claim a SOC 2 report or ISO 27001 certification, and does not offer HIPAA-supported processing of protected health information. SOC 2 is an independent attestation, not a status inherited from hosting providers. GDPR compliance depends on actual processing, contracts and operating practices, not a badge or a configuration setting. Payment-card processing is handled by the merchant of record; this is not a claim that Annot8 itself has a PCI DSS validation. Customers with assurance requirements should request current evidence before purchase.