Security

Your data is kept apart

• Every agency is its own workspace. Every query in the dashboard is limited to the signed-in agency, and an automated test checks that two agencies using the same names never see each other's sites, changes or people.
• Screenshots, files and recordings are kept in private storage. They are only served to signed-in teammates of the agency, or through a signed link that expires.

Reviewers do not need accounts, and links are safe

• A review link is a random 256-bit secret. We look links up by a hash. A copy is also kept encrypted so you can see the link again in your dashboard, and reading it needs a secret key that is not in the database. Links expire, and you can revoke or regenerate one at any time.
• The widget only works on the addresses you list for a site, and only for a reviewer whose link is live. A reviewer sees only their own comments.
• Every request is rate limited, and uploads are checked by their real content, not just their name.

Accounts and access

• Passwords are stored only as salted scrypt hashes. Sign-in attempts are rate limited.
• Removing a teammate signs them out on their next request.
• API keys for the AI integration are shown once, stored only as a hash, and can be revoked.

In transit and at rest

• All traffic uses HTTPS. The dashboard sends security headers that prevent framing and sniffing.
• Our database and file storage providers encrypt data at rest and keep backups. See the sub-processor list.

Recording, deleting and exporting

• Reviewers accept a notice before their first voice note or screen recording, and we record when.
• You can delete a change, a site or your whole account, and download all your data, from the dashboard. Retention periods are in the privacy policy.

What we do not have yet

• We are not SOC 2 or ISO 27001 certified, and we do not offer single sign-on, two-factor sign-in, a HIPAA programme or business associate agreements. If one of these decides whether you can use us, tell us.
• The service is not designed for health records. Use it for marketing and staging sites (see acceptable use).

Reporting a problem

If you find a security problem, please email security@greatnessdigital.com. We will answer within two working days, and we ask you to give us time to fix it before telling others. If a breach affects your data, we will tell you without undue delay.