SigmoraSecurity
Security
Authentication
Accounts are secured via Firebase Authentication. Passwords are never stored in plain text. We support email/password and Google sign-in. All sessions use short-lived ID tokens.
Transport
All traffic is encrypted in transit via TLS 1.2+. API routes enforce HTTPS.
Data isolation
Workspace data is scoped per workspace in Firestore. Users cannot access data outside their workspace. All API routes verify workspace membership before returning data.
Payments
Card and subscription processing is handled by Stripe or Whop. Paystack is restricted to supported USSD and M-Pesa flows. We never see or store your card number, and provider webhook signatures are verified before any entitlement is granted.
Rate limiting
API endpoints are rate limited per IP and per user to prevent abuse. Webhook endpoints use Redis-backed deduplication to prevent replay attacks.
Reporting a vulnerability
If you discover a security issue, please disclose it responsibly through our vulnerability report form. Reports are handled first, and we aim to respond within 48 hours.