Security

In place

• TLS on every connection, certificates renewed by the platform, no mixed content.
• Passwords hashed with salted scrypt; a reset link expires, is single use, and never says whether an address has an account.
• Session cookies are signed, HttpOnly and SameSite=Lax.
• API keys are per workspace, revocable, and shown once.
• Every database query is scoped to a workspace, so one customer's project cannot be read by another.
• Webhook deliveries are HMAC-signed with a per-hook secret and retried with backoff.
• Rate limits on signup, sign-in, password reset, the free demo and the API.
• Administrator actions - plan changes, grants, sign-in-as - are written to an audit log that cannot be edited from the console.
• Generated audio is watermarked and carries a synthetic-media disclosure, so a file can be traced to the account that made it.
• Encrypted backups, and a restore that is tested rather than hoped for.
• Secrets live only in the platform environment: none in the repository, the logs or a page.

Honestly, what we do not have

No SOC 2 or ISO 27001 certificate. No 24/7 on-call rota and no uptime SLA on self-serve plans - the status page shows the real thing instead. No bug bounty budget, though credit is given. If your procurement requires certification, we are not the right supplier yet, and it is cheaper for both of us to know that now.

Reporting a vulnerability

Write to hello@naadly.com with steps to reproduce. We acknowledge within two working days, fix serious issues before anything else, and credit you unless you would rather we did not. Please do not run load tests, do not touch other customers' data, and give us 90 days before publishing.