Security
No certification badges we have not earned. This is what is actually implemented — written so your security reviewer can check every line of it.
Every row carries a workspace id and every query is filtered by it before it runs. A request naming a workspace you do not belong to is refused at the middleware, and objects inside it return 404 rather than 403 — which avoids confirming they exist.
Short-lived access tokens with refresh rotation: each refresh issues a new token and blacklists the one used, so a stolen refresh token stops working the moment the real device refreshes.
Sign-in, one-time codes and email lookups each have their own budget, so guessing a password or harvesting which addresses have accounts is slow and noisy rather than free.
The app carries a nonce-based policy with no 'unsafe-inline' in script-src, so markup injection cannot become code execution.
HTTPS enforced with HSTS including subdomains and preload, secure HTTP-only cookies, and a server that refuses to start with a development key or a wildcard host.
Attachments are served with a sandboxed policy that strips scripting, so a file uploaded with a misleading name cannot run as a page in someone else’s browser.
No audio is stored — not in the database, not on the server. Only the words of what you said reach us.
Sign in with Google, with Microsoft, or with an email address and a one-time code. Social sign-in verifies the provider’s token on our server — against Google’s token endpoint and Microsoft’s public signing keys — rather than trusting anything the browser sends us.
Turn on two-step sign-in and every way in — password, email code, password reset, Google, Microsoft, web or phone — also asks for a code from an authenticator app, and each code works once. Ten single-use recovery codes, shown once when you turn it on, get you in if the phone is lost.
Application data is stored in a PostgreSQL database; uploaded files on the application’s own storage. We do not sell data, we do not use it to train anything, and we do not share it with third parties except the infrastructure providers needed to run the service.
Card details never reach our servers. Payment is handled by a payment provider, and our database holds only a subscription period and a reference issued by that provider. There is nothing card-shaped in it to steal.
Where we're taking security next — listed plainly, so your reviewer knows what is here today and what is coming.
Independent penetration testPlanned — an outside team testing the app, with the findings fixed before we say it's done.
SOC 2 and ISO 27001Once we reach the scale that calls for a formal audit.
Choice of data regionFor larger teams on a dedicated server — talk to us.
Security keys and passkeysNext after authenticator apps, which work today on every account.
Email admin@lyomastech.com with enough detail to reproduce it. We confirm receipt within three working days. Please give us a reasonable window to fix it before publishing, and do not access data that is not yours while testing.