Security

• Documents are encrypted at rest with AES-256-GCM, each file with its own derived key, and checked for tampering whenever opened.
• Encrypted in transit over HTTPS with strict security headers.
• Two-step verification with an authenticator app is available to every member and recommended for administrators.
• Passwords are stored with memory-hard hashing, never in plain text.
• One-time codes are hashed, expiring, single-use and rate-limited.
• Private files are stored outside public access, type-checked and hashed. Every access is logged.
• Tamper-evident audit log with a hash chain.
• Sessions use HTTP-only cookies, CSRF protection and strict security headers.
• Consent ledger records what you agreed to and when.

Email one-time codes prove control of a mailbox only. They do not prove identity.