What protects your workspace.

Sign-in and sessions

• Passwords are hashed

  PBKDF2-SHA256 with 100,000 iterations and a random salt per password, compared in constant time. Unknown emails get the same answer as wrong passwords.

• Brute force is throttled

  Five failed sign-ins per email in 15 minutes, and 30 per IP address, lock further tries out for a while, even with the right password.

• Session tokens are stored as hashes

  256 random bits, stored only as a SHA-256 hash, so a copy of the database can't be replayed. Sessions expire after 30 days, and changing your password signs out every other session.

• No cookies to forge

  The API reads tokens only from the Authorization header, never from cookies or URLs, so there is no CSRF surface.

AI tools and connectors

• MCP clients sign in with OAuth

  PKCE is required, codes are single-use and last 5 minutes, and access tokens last an hour. Tokens are stored as hashes and act only as the member who signed in.

• Agent code runs in a sandbox

  Programs sent to the MCP server run in a fresh, isolated Worker with no network access and an empty environment, limited to 30 seconds, 10 seconds of CPU and 200 tool calls.

• Connector requests are signed

  Hasarak signs every request to a connector with an Ed25519 key, so a connector can reject anything that didn't come from Hasarak.

• Connectors get only what they ask for

  An admin approves each permission (read messages, write pages, …), calls outside them are refused, and connectors can't see DMs.

Access in the workspace

• Admins, members and guests

  Admins manage settings, connectors, members and invites. Guests can't see private channels or other members' email addresses and can't edit pages.

• Removing someone is immediate

  Deactivating a member deletes their sessions and MCP tokens for that workspace.

• Invites expire

  Invite links are single-use, stored as hashes, and expire after 7 days.

Hosting, backups and the web

• Hosted by OVHcloud in the United Kingdom

  Workspace data and files live on our server there. The file store is private: every read and write is signed.

• Encrypted, off-site backups

  Encrypted snapshots every 6 hours to Cloudflare, Inc. (R2) in the EU, kept for 30 days, plus daily copies that can't be deleted or changed until they expire. A missed backup alerts us.

• HTTPS and a strict browser policy

  Everything is served over HTTPS with HSTS. The web app and this site run under a Content Security Policy that allows no inline scripts and no third-party scripts.

• No ad trackers

  Product analytics go to PostHog, as the privacy policy describes, and the web app sends none while your browser sends Do Not Track. We don't sell personal data.

Your data stays yours

• Export everything

  Workspace admins can download channels, messages, threads and pages as one JSON file (pages as Markdown) from Settings › General.

• Delete your account

  Settings › Account › Delete account removes your account and memberships and revokes your sessions and tokens.

• Deleted means deleted

  Data is deleted within 30 days of an account or workspace being closed. Backups that still hold it expire after 30 days.

Not yet

• Single sign-on (SAML or OIDC)

  Not yet. Members sign in with email and password.

• Two-factor authentication

  Not yet.

• End-to-end encryption

  No. The server reads messages so it can search them and pass them to the connectors you install.

• Compliance reports (SOC 2, ISO 27001)

  Not yet. We don't claim certifications we don't have.

Questions