Security
Last updated: today
Encryption
All traffic is TLS 1.2+ in transit. Data at rest is encrypted via AES-256 (managed disk encryption). Per-project data isolation by row-level keys.
Headers & policies
Every response carries Content-Security-Policy, HSTS (HTTPS only), X-Frame-Options DENY, Referrer-Policy strict-origin, and Permissions-Policy disabling camera/mic/geolocation.
Authentication
JWT with HS256, 24-hour TTL, bcrypt password hashing (cost 12). SSO via SAML 2.0 on Enterprise tier. MFA via TOTP available on all tiers.
Audit log
Every authentication, integration change, and tier change is written to an immutable audit log. Export to CSV is available on Enterprise tier.
Disclosure
Report vulnerabilities to security@watchtower.example. We respond within 24 hours and pay bounties for confirmed issues per our policy.