Security controls and limitations

Sessions use Secure, HttpOnly, SameSite=Lax cookies and expire after 30 days. Password login is limited to five failed attempts per IP in 15 minutes.

New passwords use PBKDF2-HMAC-SHA256 with 600,000 iterations and a unique 16-byte salt. Successful login transparently replaces older 100,000-iteration hashes.

HubSpot data-source credentials are encrypted with AES-256-GCM before D1 storage. Application-layer encryption is not yet uniform for the separate Notion, Jira, Linear, ClickUp, Asana, Slack, and GitHub operational integrations.

Production responses enforce HTTPS, HSTS, MIME sniffing protection, a restrictive Permissions Policy, origin checks on API requests, and authentication plus per-session rate limits on private API routes.

The Content Security Policy blocks objects, frames, inline event-handler attributes, unauthorized form targets, and non-self base URLs. It reports violations to our CSP report endpoint.

The current vinext hydration stream and React inline styles still require 'unsafe-inline' for script elements and styles. The CSP therefore reduces exposure but is not represented as a complete XSS boundary.

Application records are stored in Cloudflare D1 and generated presentation files in Cloudflare R2. Connected CSV or HubSpot source excerpts may be sent to the configured OpenAI or Anthropic model to generate a deck.

Provider retention, zero-data-retention status, regional processing, DPAs, and backup deletion depend on the deployed vendor accounts and contracts; this repository does not prove those settings.

Anonymous demo generation, anonymous MCP generation, and public remix pages are disabled. Account users must accept the current Terms and Privacy Policy before private APIs permit generation.

Account deletion removes application rows, sessions, API keys, all known local integration credentials, and recorded presentation objects. R2 object deletion is attempted after the database deletion and failures are logged for operational cleanup.

Deleting a local connector does not necessarily revoke access at the upstream provider. Users must revoke the relevant OAuth grant, private-app token, webhook, or app installation with that provider when the product identifies that step.

Deletion from provider-managed backups is subject to provider retention schedules and cannot be promised from application code alone.