Security & privacy

Redaction happens before anything leaves your browser

The Chrome extension detects password, payment, and PII-looking fields and masks them on-screen before a screenshot is ever captured — the unredacted image never leaves the browser. The API independently refuses to store a screenshot of a sensitive-looking field with no redaction applied, as a second layer of defense.

Sessions

The dashboard's session lives in an httpOnly cookie, never in browser storage a script on the page could read. Refresh tokens rotate on every use and are stored hashed, so a replayed stolen token stops working after first use. A password reset or change revokes every other active session automatically, and you can review and revoke individual sessions yourself at any time.

The extension holds its own scoped credential

The Chrome extension never sees your password or your dashboard session. It's connected using a short-lived, single-use pairing code generated from the dashboard, bound to one organization — and it can be revoked independently, at any time, without affecting your own login.

Tenant isolation and access control

Every request is authorized server-side against a six-role permission matrix (viewer through owner) resolved from the database — never inferred from anything the client sends. A request for another organization's data returns the same "not found" response as a nonexistent one, rather than revealing that the organization exists.

Account and organization deletion

You can delete your account or your organization yourself, with a password confirmation. Deleting an organization deactivates it immediately and permanently removes its data — including stored screenshots and exports — after a 30-day recovery window, so an accidental deletion can still be caught in time.

Exporting and deleting your data

Organization owners can request a self-service export of their organization's data (metadata, members, projects, and generated content, including the current screenshot for each exported step — never a superseded pre-redaction original, and not every historical screenshot ever captured) from Settings at any time; the archive is available for a limited window and then automatically deleted.

Report a vulnerability

If you believe you've found a security issue, please email security@processkit.local with details — we don't yet have a formal bug-bounty program, but we take every report seriously and will respond as quickly as we can.

What isn't built yet

• Multi-factor authentication.
• A formal third-party security review or penetration test.
• A real CAPTCHA vendor integration (the hook exists; no vendor is wired up).