Security

Below is what's actually true today about how this product protects your data, checked against the real code, not aspirational copy. If you've found a security issue, skip to "Reporting a vulnerability" below.

Passwords are hashed, never stored in plain text. Sessions are opaque and individually revocable. A password reset immediately signs out every other device. Two-factor authentication (an emailed code at login) is available and opt-in. Every workspace's data is isolated from every other workspace at the database-query layer, not just hidden in the interface. Confidential engagement notes are enforced server-side, visible only to a workspace's Owner. Card and bank details never reach this product's own servers (checkout runs entirely on Paystack's hosted page), and every payment webhook is signature-verified before anything is trusted. Everything runs over HTTPS with HSTS enforced, with a Content-Security-Policy header restricting what a page can load. Weekly database backups exist and have actually been restored and checked, not just assumed to work.

A signed-in person can also download or permanently delete their own account data at any time, from Account & security in settings. No need to ask anyone.

There's no independent, external security review yet: every check so far has been internal. That's a deliberate choice at today's scale, not an oversight, and it's worth being upfront about rather than implying otherwise. There's also no bug bounty program and no committed response-time SLA for a reported issue (e.g. "acknowledged within 48 hours"), both worth adding once there's a team to guarantee them against.

If you've found a security issue, we want to know before anyone else does. Email support@minista.app or use the support page, with enough detail to reproduce what you found. We'll acknowledge receipt and won't argue severity in the reply before actually assessing it. There's no bounty on offer today, but if you ask to be credited once it's fixed, that's a real conversation we'll have.

If your research stays within the rules below, we consider it authorized and won't pursue legal action against you for it:

• Test only against your own account or a workspace you control: never access, modify, or exfiltrate another user's data, even to prove a finding.
• Don't run automated scanning or load testing that could degrade the service for real users.
• Report privately, here, before any public disclosure: give us a reasonable chance to fix it first.
• Don't use a finding for anything beyond demonstrating it: no further access, no data retention, no third-party disclosure.

This is a good-faith commitment, not a substitute for legal advice on either side, and it can't bind a third party (for example, Paystack or Railway) whose own systems your research might touch.

If this page changes in a way that matters, we'll update the date at the top. The full, longer-form version of this (including what's Confirmed, Partial, or an open Gap, and why) is tracked internally and kept in sync with this summary.