Security overview

Authentication

Doxus uses SuperTokens for authentication, session handling, password reset, and email verification flows.

Tenant-scoped routes, service logic, and database access are designed around workspace boundaries and explicit authorisation checks.

Browser and service connections use transport encryption where configured by the hosting, edge, and provider stack.

Stored data protection depends on the managed infrastructure, database, storage, backup, and provider configuration in use.

Production secrets are intended to be managed outside source code and delivered through controlled deployment configuration.

Application logging is expected to avoid sensitive values and reduce customer content in diagnostics where practical.

Security events are triaged through operational review, provider logs, error monitoring, and customer communication where required.

Backup and restore behaviour depends on managed database and storage configuration, operational runbooks, and retention settings.

Administrative access is intended to be limited to authorised operators with a need to support, secure, or maintain the service.

Security concerns can be reported to security@doxus.app with enough detail for investigation.

This page is a trust overview. It does not claim external audit status or a specific assurance framework.