Security
Built with organization boundaries in mind.
What’s actually in place today — described plainly, not oversold.
Secure authentication
Passwords are hashed, never stored in plain text. Login and password-reset are built to not reveal via timing whether an email address has an account.
Secure sessions
Session tokens are signed, httpOnly, and scoped to your browser. Resetting your password invalidates any session issued before the reset — including one on a device you no longer control.
Organization-scoped data
Every study, team member, and recruitment record is scoped to your organization. Non-admin roles only see the studies they’re explicitly assigned to, even within their own org.
Signed webhook verification
Both Stripe billing events and the Trust Bridge participant-status sync are verified with signed, timestamped requests — a request without a valid, fresh signature is rejected before any data is touched.
Rate limiting
Login, signup, password reset, the inbound integration endpoint, and the public API are all rate-limited — per IP where there is no account yet, per API key where there is — to slow down abuse.
Audit logging
Security-relevant actions — rejected webhook attempts, recruitment status changes — are recorded for later review.
The access path for every request
What we don’t claim
We don’t hold SOC 2, HIPAA, ISO, or GDPR certification, and we won’t claim one until it’s actually been independently verified and earned. The controls above have been through internal security review and testing, but no independent third-party security audit has been performed yet. If that matters for your organization’s procurement process, tell us — we’d rather be direct about where things stand than overstate it.