Security

Accounts and sessions

• Passwords are hashed with bcrypt at cost factor 12. The plaintext is never stored and never written to a log.
• Sign-in attempts are rate-limited with an atomic, database-backed counter, so a credential-stuffing run gets slowed down rather than a free retry loop.
• Sessions are signed JWT cookies with a 7-day lifetime, rotated daily while in use. Signing out clears the cookie.
• Post-login redirects only ever go to same-origin paths, which closes the open-redirect trick phishing kits rely on.

Role isolation, enforced where it counts

A client portal user can never receive a bill rate, a cost rate, or a margin. That rule lives in the database query layer: the queries that serve the portal are structurally unable to select those columns, so there is no UI bug that could leak them. A dedicated test suite (23 assertions) tries to reach the money columns as every non-admin role and fails the build if any path opens up.

Staff roles are scoped too: members see the projects they are assigned to, and admin-only areas are enforced in the request proxy before a page ever renders.

The application layer

• Every response carries a Content-Security-Policy with a fresh per-request nonce and strict-dynamic, so an injected inline script does not execute. Frames are refused outright (frame-ancestors none), which is the clickjacking defence.
• All traffic is HTTPS; the host redirects plain HTTP and serves HSTS.
• API keys are shown once at creation, stored only as SHA-256 hashes, verified with constant-time comparison, and scoped read or write. The API authenticates by bearer token only, never by session cookie, so a signed-in browser cannot be tricked into driving it (the classic CSRF shape).
• URL and form inputs are validated before they reach the database. A malformed id gets a 404, not a stack trace.
• Every change that touches money (rates, time, periods, re-rating, bulk edits) writes to an append-only audit log: who, what, before, after.

Infrastructure

• Application hosting: Vercel. Database: Neon Postgres in AWS us-east-2 (United States), TLS in transit, encrypted at rest.
• Secrets live in the deployment environment, never in the repository. Database credentials are rotated when anyone with access changes.
• The public marketing pages you are reading are the only routes a crawler or a stranger can reach. Everything else requires a session and is marked noindex.

Backups you can believe

Backups only count if a restore has actually been performed, so we run restore drills against a copy of production. In the most recent drill we deleted 42 time entries and 32 tasks from the copy, restored 1,177 rows in about two seconds, and verified the result matched production by checksum. The restore tool refuses to touch the live database unless it is passed an explicit flag, so a fat-fingered command cannot overwrite production by default.

What we do not have yet

Being straight about the gaps is part of the point of this page:

• No SOC 2 report. Billable is a small product. The engineering controls above are real; the audit paperwork does not exist yet.
• No two-factor authentication or SSO yet. Sign-in is email and password. Both are on the roadmap, and this line gets deleted when they ship.
• Single region. Data lives in one US region. Good backups, no multi-region failover.

If any of those is a hard requirement for you, we would rather you know before you sign up than after.

Reporting a vulnerability

Found something? Email zach@opsautomators.com with enough detail to reproduce it. You will get a human reply within 3 business days, usually faster.

• Good-faith research is welcome and we will not take legal action over it.
• Please do not access data that is not yours, degrade the service, or test against other customers’ workspaces. If you need a test account to poke at, ask and we will set one up.
• Give us reasonable time to fix an issue before publishing it. We are happy to credit you when it is resolved.