Security
How the platform protects accounts and credentials.
This document is a working draft and does not yet constitute the final legal terms of the service.
Passwords
Passwords are hashed with Argon2id using parameters in line with current OWASP guidance. Plaintext passwords are never stored or logged.
Sessions
Sessions use a random token delivered in an HttpOnly, SameSite cookie, marked Secure in production. The database stores only a SHA-256 hash of the token. Sessions can be listed and revoked individually, and changing your password invalidates all of them.
Credential storage
Provider credentials are encrypted with AES-256-GCM, an authenticated cipher, so tampering is detected on decryption. The master key is supplied through the environment and is versioned to allow rotation.
Application protections
The application sets a Content Security Policy with per-request nonces, HSTS in production, frame-ancestors none, and a restrictive permissions policy. State-changing requests require a CSRF token and an origin check. Authentication endpoints are rate limited. All input is validated on the server.
What we do not claim
N22 holds no security certification at this time. We make no claim of SOC 2, ISO 27001 or any other audited compliance status, and we will not display such a claim unless and until it is genuinely obtained.
Reporting a vulnerability
If you believe you have found a security issue, please contact us before disclosing it publicly so we can address it.
Last updated: 2026-08-10