Security

Security is built into CutSuite at multiple layers. This page summarizes our practices for platform subscribers and their teams.

Authentication

• Password hashing: Passwords are hashed with bcrypt (cost factor 12). We never store plaintext passwords.
• HTTPS everywhere: Production traffic is served over TLS. Session cookies are scoped to secure contexts in production.
• Google sign-in: Company admins may sign in with Google OAuth. When your Google account has two-factor authentication enabled, that protection applies to Google sign-in.
• Login lockout: Repeated failed login attempts trigger a temporary lockout to slow credential-stuffing attacks.
• Session limits: Admin sessions expire after 7 days; super-admin sessions expire after 8 hours. Super-admin access may be restricted by IP allowlist.

Access control

• Role-based permissions separate platform owners, company admins, team members, and customers
• Company data is scoped to the authenticated company — IDs from the client are never trusted
• Super-admin is a separate deployment on its own subdomain, isolated from customer traffic
• Admin mutations are recorded in an audit log (actor, action, sanitized input, IP)

Infrastructure

• Hosted on Fly.io with encrypted connections to managed PostgreSQL
• Secrets stored as environment variables, synced via deployment tooling — not committed to source control
• Rate limiting on public mutations, auth endpoints, and uploads when Redis is configured
• Cloudflare Turnstile captcha on sensitive public forms when configured
• Content Security Policy headers (report-only by default, enforceable in production)

Automated backups

Production databases run on Fly Postgres with automated daily backups and point-in-time recovery options provided by the hosting platform. Backups are encrypted at rest. We test restore procedures periodically and retain backups according to our disaster-recovery plan.

Backups protect against data loss at the infrastructure level. They are not a substitute for exporting your own business records — see Data Rights for export options.

Payments

Subscription billing is handled by Stripe. Card data is collected and stored by Stripe, not on CutSuite servers. Stripe is PCI DSS compliant.

Incident response

If we become aware of a security incident affecting your data, we will investigate promptly and notify affected subscribers as required by law and contract.

Your responsibilities

• Use a strong, unique password or sign in with a Google account that has 2FA enabled
• Remove access for team members who leave your company
• Report suspected compromise to us immediately — see Data Rights

Vulnerability reports

If you discover a security issue, please report it responsibly to security@cutsuite.com. Do not publicly disclose vulnerabilities before we have had a reasonable chance to address them.