Security

What we actually do — and what we don't claim.

What we do

• Tenant workspaces are isolated by API key; keys are stored only as SHA-256 hashes, and checkout credentials are revealed exactly once through the claim flow.
• Requester identity is confirmed with single-use, expiring email links (hash-stored tokens) before fulfillment; stronger detail checks or manual review are configurable.
• Requester names and emails live in a database with restricted OS permissions — keep it off shared hosts. Response packages reach requesters through expiring download links, not email attachments.
• Input validation on intake (type, regulation, email format, length caps); the state machine rejects illegal transitions; denials and extensions require recorded reasons.
• We are not SOC 2 certified. The audit trail is the accountability feature.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+dsarflow@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.