Security
Last updated: March 2026
Infrastructure
Applications are deployed on isolated container infrastructure with automated backups, monitoring, and SSL/TLS encryption in transit.
Authentication
Sign-in is email and password only — we never use magic links. New accounts and password resets are confirmed with a 6-digit code sent to your email, not a clickable link. Optional two-factor authentication (TOTP, via any standard authenticator app) is offered on every account. Session tokens are HTTP-only, secure, and SameSite-protected.
Data Protection
Data ownership is enforced in application code: every database query that touches your data is scoped to your account, structurally, at the code level, not left to be added per-query. All API endpoints verify authentication and authorization before processing requests.
Payment Security
All payment processing is handled by Stripe. DeNovo never stores, processes, or transmits raw payment card data.
Reporting Vulnerabilities
To report a security vulnerability, contact [email protected].