Overview

Security is a foundational principle at Paxalia — not an afterthought. We implement defence-in-depth across every layer of our infrastructure, applications, and development practices. This page documents the security controls we have in place to protect your data, how we handle incidents, and how you can report vulnerabilities.

Paxalia is built with the understanding that your time data, notes, goals, and personal information are sensitive. We treat them with the same care we would want for our own data. Our approach is guided by three principles: encrypt everything possible, grant the least privilege necessary, and test continuously.

Data Protection

We protect your data at rest and in transit using industry-standard controls:

  • Encryption in transit: All communication between your device and our servers is encrypted using TLS 1.3. This prevents eavesdropping, tampering, and man-in-the-middle attacks. Our API endpoints enforce HTTPS exclusively — no unencrypted traffic is accepted.
  • Encryption at rest: Sensitive data stored in our PostgreSQL database is encrypted at rest using disk-level encryption. Passwords are hashed using bcrypt with a work factor of 12, making them computationally expensive to crack.
  • API sanitization: All user-generated HTML content (notes, pages, chat messages) is sanitized using nh3 — a Rust-backed HTML sanitizer built on the ammonia library. This strips malicious scripts, unsafe attributes, and dangerous protocols, preventing XSS attacks at the server level.
  • Content Security Policy: We enforce a strict Content Security Policy (CSP) that blocks all inline scripts and restricts the sources from which scripts, styles, and other resources can be loaded. This provides an additional layer of protection against injection attacks.
  • Data minimisation: We collect only what is necessary to provide the service. We do not store unnecessary personal information, and we regularly review our data retention practices to ensure we are not keeping data longer than needed.

For more details about what data we collect and how we handle it, see our Privacy Policy.

Access Control & Identity

We control who can access our systems and customer data using a combination of strong authentication, authorisation, and least-privilege principles:

  • JWT authentication: All API requests are authenticated using short-lived JSON Web Tokens (JWTs). Access tokens expire after 1 hour, and refresh tokens rotate automatically. This limits the window of exposure for compromised tokens.
  • Two-factor authentication (2FA): Users can enable optional 2FA using TOTP (Time-based One-Time Password) via any authenticator app. Backup codes are provided at setup for account recovery. 2FA is mandatory for administrative accounts.
  • Role-based access control: Workspace members have distinct roles — Owner and Member. Owners have full control over workspace settings and member management. Members can create, edit, and delete content but cannot manage other members or workspace settings.
  • Device management: Users can view and revoke active device sessions from the app. Each session is tied to a unique device fingerprint, and revoked devices are logged out immediately across all services.
  • CSRF protection: All state-changing requests are protected against Cross-Site Request Forgery using Django's built-in CSRF protection. This prevents attackers from making unauthorised requests on behalf of authenticated users.
  • Rate limiting: Sensitive endpoints are throttled to prevent abuse. Login attempts, password resets, and API requests are limited to reasonable rates, protecting against brute-force and denial-of-service attacks.
  • Account lockout: After 8 consecutive failed login attempts, accounts are temporarily locked for 30 minutes. This mitigates password-guessing attacks without locking out legitimate users who may have forgotten their password.

Infrastructure & Hosting

We run Paxalia on a hardened infrastructure designed to protect against both external and internal threats:

  • Deployment: Our servers run on a dedicated VPS with a reputable provider. All systems are managed using infrastructure-as-code principles, ensuring consistent and auditable configurations.
  • Network security: All inbound traffic is blocked by default except for HTTP/HTTPS traffic. Direct access to the origin server is restricted — only Cloudflare's proxy network is permitted. This prevents attackers from discovering and targeting the underlying server IP.
  • DDoS protection: We use Cloudflare's DDoS protection at layers 3, 4, and 7 to mitigate volumetric and application-layer attacks. This ensures the service remains available even during large-scale attacks.
  • Firewall: UFW (Uncomplicated Firewall) is configured with strict default policies — deny incoming, allow outgoing. Only essential ports (SSH, HTTP, HTTPS) are open, and SSH is accessible only via public key authentication with password authentication completely disabled.
  • Automatic patching: Security updates for the operating system, dependencies, and container images are applied continuously. We minimise the window of exposure for zero-day vulnerabilities.
  • Database security: PostgreSQL is configured with strong authentication, connection pooling, and regular automated backups. Access to the database is restricted to the application server only.
  • fail2ban: We use fail2ban to monitor log files and automatically ban IPs that show suspicious behaviour (repeated failed login attempts, even with keys). This adds an additional layer of protection against brute-force attacks.

Vulnerability Management & Testing

We proactively identify and fix vulnerabilities through a combination of automated and manual testing:

  • Dependency scanning: All dependencies are scanned for known vulnerabilities using automated tools in our CI pipeline. We receive alerts for any new CVEs affecting our dependencies and patch them promptly.
  • Static analysis: We use static code analysis to detect security anti-patterns, SQL injection vulnerabilities, and unsafe coding practices before code is merged.
  • Dynamic analysis: Regular scans are performed to identify misconfigurations, exposed endpoints, and other security issues in production and staging environments.
  • Regular reviews: We conduct periodic internal security reviews of our codebase, infrastructure, and access controls. These reviews help us identify and fix issues before they become incidents.
  • Responsible disclosure: We welcome reports from security researchers. Our responsible disclosure policy encourages safe and private reporting of vulnerabilities, and we work with researchers to validate and address issues.
  • Third-party testing: We engage third-party security experts to perform penetration testing on a regular basis. Executive summaries are available upon request to enterprise customers with appropriate confidentiality agreements.

Incident Response & Notifications

We maintain a comprehensive incident response plan to handle security events swiftly and effectively:

  • Incident response plan: Our plan follows the industry-standard framework: Identify → Contain → Eradicate → Recover → Review. We test this plan regularly through tabletop exercises.
  • Monitoring and detection: We centralise logs from all systems and monitor for anomalies, including failed authentication attempts, unusual traffic patterns, and suspicious database queries. Alerts are configured to notify the appropriate team members in real time.
  • User notifications: If a security incident impacts user data, we will notify affected users as soon as possible, following applicable notification laws and regulations. Notifications are sent via email and in-app messages, and we provide clear guidance on next steps.
  • Post-incident review: Every incident is followed by a thorough review to identify root causes, improve our controls, and prevent recurrence. Lessons learned are documented and shared with the team.
  • Status page: We maintain a status page for major incidents and planned maintenance. Users can subscribe to updates to stay informed about the service's operational health.

Responsible Disclosure

We take security seriously and welcome reports from security researchers who identify vulnerabilities in our systems. We believe in collaboration and are committed to addressing issues responsibly.

Guidelines for researchers

  • Report privately: Please send reports to [email protected] with the subject prefix [SECURITY]. Include a clear description of the vulnerability, steps to reproduce, and the potential impact.
  • Give us time: Allow us a reasonable period (minimum 72 hours) to investigate and address the issue before disclosing it publicly. We will keep you informed of our progress.
  • Do not exploit: Do not exploit the vulnerability beyond demonstrating it, do not access or modify user data, and do not disrupt the service.
  • Be respectful: Treat our team and our users with respect. We are committed to working collaboratively to resolve issues.

What we will do

  • Acknowledge: We will acknowledge receipt of your report within 72 hours.
  • Investigate: We will investigate the issue and provide regular updates on our progress.
  • Remediate: We will fix the issue and deploy the fix as soon as possible. We will notify you when the fix is complete.
  • Credit: If you wish, we will credit you in our release notes for the fix, subject to your consent.

Reporting channel: [email protected] — please use [SECURITY] in the subject line. If you need to send encrypted data, please contact us via the same address to arrange a PGP key exchange.

Compliance & Audits

We maintain compliance with relevant privacy and security regulations:

  • GDPR readiness: Paxalia is designed to comply with the General Data Protection Regulation (GDPR). We provide users with the ability to access, correct, export, and delete their personal data on request. Our data processing activities are documented and aligned with GDPR requirements.
  • Data Subject Access Requests (DSARs): Users can exercise their rights by contacting us at [email protected]. We will respond to verified requests within the timeframe required by law.
  • Data Processing Agreements: We enter into Data Processing Agreements (DPAs) with all service providers who handle user data. These agreements ensure that processors meet the same data protection standards we apply to ourselves.
  • Internal audits: We conduct regular internal audits of our security controls, access policies, and data handling practices. Audit findings are tracked and remediated as part of our continuous improvement process.
  • Future certifications: We are actively working toward SOC 2 Type II and ISO 27001 certifications. We will publish summary-level attestation reports when available.

For security or compliance questions, or to request a copy of our Data Processing Agreement, please contact us at [email protected].