Security

• Accounts sign in with email and password through a managed authentication provider; passwords are hashed and never stored by us in readable form.
• Email confirmation is required before an account becomes active, and password resets are done through time-limited emailed links.
• Dashboard routes are gated behind an authenticated session, and every server call is re-verified server-side with the caller's bearer token.
• Team access is per project and invitation-based; project API keys and settings stay owner-only.

• Row-level security policies in the database restrict every read and write to the project's owner and invited members.
• Each project has its own API key, so a widget or agent integration can only reach that project's reports.
• Widget submissions can be restricted to an allow-list of origins you nominate per project.

• All traffic to the app, the widget and the API is served over HTTPS.
• Data is encrypted at rest by our database and object-storage provider.
• Screenshots and recordings are stored in a private bucket and served only through short-lived signed links, never as public files.

• Public ingest and AI endpoints are rate limited.
• Submitted payloads are schema-validated on the server before being stored.
• Incoming GitHub webhooks are verified with a signing secret before being processed.
• Credentials and API tokens are held in the platform's secret store, not in source code.

We secure the platform, its infrastructure and the isolation between projects. As a customer you are responsible for keeping your project API keys private, deciding who you invite to a project, telling your website's users what the widget collects, and not using Hitloop to gather payment, health or other sensitive data.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We do not currently hold SOC 2, ISO 27001 or other third-party certifications, and nothing on this page should be read as such a certification.

Please report suspected vulnerabilities to security@momentumcloud.com.au with steps to reproduce. We will acknowledge your report and keep you updated while we investigate. Please do not access other customers' data or run disruptive tests against production.