Security & Data Protection

1. Our Security Commitment

At WithUs, security is the foundation of our credential delegation architecture. We use technical and organizational measures designed to protect data and credentials.

2. Credential Encryption

3. Access Controls & Authentication

• Session SecurityAuthentication sessions use HTTP-only cookies where implemented, helping prevent client-side JavaScript from directly accessing authentication tokens. The application configures authentication cookies with security attributes including HTTP-only handling and production-specific Secure/SameSite settings where applicable.
• Role-Based Access Control (RBAC)Access to credentials and organizational settings is strictly governed by user roles (Owner, Admin, Member, Delegate).
• Admin ControlsAuthorized organization administrators can manage delegated access and revoke applicable sessions according to their assigned permissions.

4. Audit Logging

makewithus maintains application-level audit records for supported security and account activities. Where captured by the application, audit records may include information such as the organization ID, acting user ID, action performed, resource metadata, and timestamp.

5. Infrastructure & Operations

• Data Isolationmakewithus uses organization-based logical data separation within its application and database architecture. Organization-scoped records are associated with their respective organization identifiers to support separation between workspaces.
• Backup & Recoverymakewithus utilizes database backup and restoration procedures for PostgreSQL data. Data is backed up via continuous Point-In-Time Recovery (PITR) provided by our database infrastructure, which currently maintains a 6-hour recovery history window. We do not utilize separate off-site backups or scheduled snapshots.

6. Monitoring & Incident Response

• Security Monitoringmakewithus implements application-level controls including API rate limiting, audit logging, and application error monitoring. Rate limiting is used to reduce abusive or excessive API requests, while application errors and exceptions are captured through our monitoring integration (Sentry).
• Incident Handling & Breach NotificationIn the event of a verified data breach, affected users will be notified without undue delay after the breach has been assessed and confirmed, subject to applicable law or where the incident presents a significant risk to their information. The notification may include information about the nature of the incident, the information potentially affected, actions taken by WithUs, and recommended steps users can take to protect themselves.