Security at SysCost

• Passwords are protected with strong, industry-standard hashing. We never store or log them in plain text.
• Sign-in never reveals whether an email address has an account, and password-reset requests always get the same answer.
• Sessions last up to 7 days. Changing or resetting your password, or choosing Sign out everywhere, ends every other session at once.
• Email confirmation and password-reset links work once and expire (after 48 hours and 1 hour).
• Two-factor sign-in is available for every account.
• Repeated sign-in, sign-up and reset attempts are slowed down automatically.

• Every record belongs to a workspace, and every request is checked against your membership in that workspace.
• Roles (owner, admin, member, viewer) decide what each person can do. Viewers cannot change anything; only admins manage integrations and teammates; only owners manage billing or delete a workspace.
• Invitations can only be accepted by the invited email address, so a forwarded link is useless to anyone else.
• Every change is written to the workspace activity log with who made it and when.

• Alerts go only to the Slack, Discord and Telegram destinations you set up, and email alerts only to teammates who joined your workspace and confirmed their address. We block any attempt to use alerts to reach private networks.
• Every delivery is time-limited, and each workspace has a sensible hourly cap.
• If a delivery fails, you see the status the destination returned, never its internal details.
• Custom webhooks are switched off during the beta. When they open, every delivery will be signed with a secret you can change at any time.
• Integration secrets such as tokens and webhook links are hidden after you save them, and never appear in error messages.

• All traffic to SysCost is encrypted in transit.
• Your data is never directly reachable from the internet; only the SysCost app can access it.
• Error messages are written for people and never expose system internals.
• You can export your workspace at any time (CSV and JSON) and delete your account from Settings. Deletion is immediate and permanent.
• Payment details are handled entirely by our payment provider and never touch our servers.

• Every release is tested before it ships.
• Everything you send us is checked before it is accepted.
• The app uses modern browser protections against common web attacks.

Email [email protected] with steps to reproduce. We acknowledge reports within two business days, keep you updated, and will not pursue legal action for good-faith research that avoids privacy violations, data destruction and service disruption.