Safeguards
- Credentials are encrypted at rest with AES-256-GCM, with each password cryptographically bound to its owner and system. They are decrypted only when an employee or a customer administrator reveals one, or an employee runs Autobookmark, and each of those actions is logged. This is encryption at rest, not end-to-end or zero-knowledge encryption; see How NewBoarding Works.
- Data in transit is protected with TLS and HSTS. Responses carry a strict Content Security Policy, frame protection, and other security headers; mutating requests are same-origin checked.
- Customer sign-in uses Microsoft Entra ID with the customer's own MFA policies. Disabled or deleted accounts lose access within minutes, and sessions are short-lived (12-hour absolute, 2-hour idle) with hashed tokens.
- Each customer's data is tagged and isolated at the application layer; a session from one customer's deployment is rejected by another's.
- Every sign-in, password view, change, export, and reset is written to an audit log that customer administrators can review.
- Least-privilege administrative roles. Rate limiting on sign-in, the demo, the consultation form, password-reset requests, password views, and administrative changes, plus a honeypot, timing checks, and size limits on the public form.
Hosting
NewBoarding runs on Vercel and stores data in a managed Neon Postgres database in the United States. See Data Processing & Subprocessors.
If something goes wrong
- We notify affected customers without undue delay and within 72 hours after confirming a security incident affecting their data, with what happened, likely consequences, and what we are doing. Customers handle notices to their own employees and regulators unless the law requires us to.
- For a breach involving personal information of Florida residents, notices follow the Florida Information Protection Act (Fla. Stat. §501.171): individuals within 30 days after determination of the breach, the Florida Department of Legal Affairs within 30 days if 500 or more Floridians are affected, and consumer reporting agencies if more than 1,000 are affected, unless law enforcement asks for a delay.
Reporting a vulnerability
Email newboarding@odysseydevelopments.dev with “Security” in the subject and the details (see also /.well-known/security.txt). Please give us reasonable time to investigate and fix the issue before disclosing it publicly, and do not access or modify data that is not yours. We will acknowledge your report and keep you informed.