Passwords and credentials
Account passwords are stored hashed, not in plain text. Telegram and Slack connection credentials are encrypted. API tokens are stored as SHA-256 hashes; the plaintext token is shown once. Full payment card numbers are not stored; WayForPay handles cards on Cloud.
The webhook signing secret is stored and shown in plaintext. Do not assume every field in the database is encrypted at rest.
Workspace access
Clients, assets, and logs belong to one workspace. Membership middleware and workspace-scoped queries keep records in that workspace. This is not a database-wide global Eloquent scope. API tokens and public client links are also workspace-scoped. Teammates only see workspaces they were invited to. Two-factor authentication is not available in the product today.
HTTPS, HSTS, and related headers are a deployment requirement, not an application-wide middleware guarantee. Production should be served over HTTPS.
The legal detail is in the Privacy Policy.