Security

This page describes the practical security measures GetConsenso uses today. We'd rather tell you plainly what we actually do than list certifications we don't hold — we're a young company, and we'll update this page honestly as our security program matures.

Infrastructure

GetConsenso runs on Vercel's managed hosting and edge network, with our database on Neon's managed Postgres. Both providers encrypt data at rest and operate within SOC 2‑audited data centers. We don't run our own servers, which means less surface area for us to get wrong.

Encryption

• In transit: all traffic to and from GetConsenso — web app, API, and CLI — is encrypted over TLS.
• At rest: your database is encrypted at rest by our hosting provider.
• Sensitive credentials: connected-integration tokens (GitHub, Linear, Jira, Slack) are individually encrypted with AES-256-GCM before they ever touch our database — not just relying on disk-level encryption.
• API keys: personal API keys you generate for the ckit CLI are stored as one-way SHA-256 hashes. We can verify a key at request time; we cannot retrieve or display it again after creation.

Authentication & access control

• Sign-in is handled by Clerk, supporting email, Google, and GitHub OAuth. We never see or store your password.
• Inside a workspace, access is role-based — Admin, Developer, and Reviewer — with reviewer-only approval actions and admin-only visibility controls.
• Project-level access can be further restricted to specific members, separate from workspace-wide roles.
• API keys and OAuth tokens are scoped to the user who created them and can be revoked instantly from your account settings.

Application security

• Rate limiting on authentication and API endpoints to slow down abuse and credential-stuffing attempts.
• Server-side validation (Zod schemas) on all API inputs, not just client-side checks.
• Outbound URL fetches (e.g. OpenAPI import from a URL) are checked against SSRF patterns before we fetch them.
• Dependency and vulnerability scanning runs in our CI pipeline on every change.

Audit & visibility

Key actions — approvals, rejections, publishes, and role changes — are recorded in an audit trail so your team has traceability over who did what and when. Higher plans retain audit history for longer, as described in our pricing.

Payments

We never see or store your full card or bank details. All billing is processed by Razorpay, a PCI-DSS compliant payment processor — GetConsenso only stores your plan status and transaction references.

Data isolation

Every workspace, project, and endpoint is scoped to its owning organization in our database, with server-side checks on every request — one customer's data is never returned in response to another customer's request.

Where we're headed

We do not currently hold SOC 2, ISO 27001, or similar third-party certifications. As GetConsenso grows — particularly for Enterprise customers — formal audits, a bug-bounty program, and SSO/SAML are on our roadmap. If your organization needs a specific control we don't yet document here, tell us; we're happy to discuss it directly.

Report a vulnerability

Found a security issue? We want to know. Email sales@reworksintelligence.com with details and, if possible, steps to reproduce. Please report privately and give us a reasonable window to fix the issue before any public disclosure — we won't take legal action against good-faith security research conducted this way.