Trust
Security
The measures below are built into this website and our client workspace today. We only list what is actually in place.
Accounts and sign-in
- Sign-in is handled by our authentication provider, Clerk. We never see or store your password.
- In production, every SolaraoLabs staff account must have two-step verification turned on before it can open the workspace. Without it, access is refused.
- Each person has a role (for example owner, sales or support), and every action is checked against that role on the server.
Keeping clients’ information apart
- Every workspace query is limited by organisation. Client accounts only ever see their own organisation’s projects, quotations, invoices, files and tickets, and our staff only see the client organisations we manage.
- Client invitation links are single-use and expire. We store only a one-way hash of each link, never the link itself.
Protecting forms and requests
- Every request that changes data must come from our own website (a same-origin check), which blocks cross-site request forgery.
- Public forms are rate limited, carry a hidden anti-spam field and have size limits. Enquiries also have an hourly cap stored in the database.
- All input is validated on the server before it is saved.
- Private links we email to you (newsletter confirmation and unsubscribe links, beta bug-report links, calendar links) are stored only as one-way hashes.
Files and payments
- Uploaded project files are limited to PDF, PNG, JPEG and WebP up to 5 MB, and their contents are checked against their stated type before they are accepted.
- Files are only served to signed-in people with access to that project.
- When online payment is switched on, card payments are taken by Stripe on Stripe’s own checkout page; card details never pass through our servers. Payment notifications from Stripe are only accepted with a valid signature.
Audit trail
- Significant actions in the workspace, such as approving a quotation, uploading a file or changing website content, are recorded with who did it and when.
Encryption in transit and browser protections
- In production the site tells browsers to always use HTTPS (HTTP Strict Transport Security), so connections to us are encrypted.
- Every page is sent with a Content Security Policy and other security headers that stop the site being framed by other websites, block content-type sniffing and limit which browser features pages can use.
Found a security problem? Please tell us through our support page. See also our privacy information.