Security

Overview

WeekScribe reads activity from the tools your team already uses, so we treat that access with care. This page describes the controls in place today. It is not a certification; we will add audits here when we have them.

Encryption

• All traffic to the website, dashboard and API uses TLS.
• The database and file storage are encrypted at rest by our hosting provider, Supabase.
• Access tokens for connected tools are additionally encrypted with AES-256-GCM before they are stored.

Access control

• You sign in with Google or with a one-time code emailed to you, so there is no WeekScribe password to leak or reuse.
• Data belongs to an organisation. Inside it, admins manage members and decide what each member can do.
• Only staff who need to support the service can reach production systems.

Connected tools

Integrations use each provider's OAuth flow where one exists, and request read access wherever the provider allows it. You can disconnect a tool from the dashboard at any time, which removes the stored tokens.

Infrastructure

WeekScribe runs on managed cloud providers. The full list, with what each one does, is in the sub-processors section of our privacy policy.

Payments

Payments are handled by Dodo Payments. Card details go straight to them and never touch our servers.

Incident response

If we confirm a security incident that affects your data, we will tell affected account owners without undue delay, explain what happened and what we are doing about it, and meet any notification duties the law places on us.

Reporting a vulnerability

If you think you have found a security issue, email contact@weekscribe.in with the steps to reproduce it.

• Give us a reasonable time to fix it before telling anyone else.
• Do not access, change or delete other people's data, and stop once you have shown the issue exists.
• Do not run denial-of-service tests or send spam.

We will not take action against good-faith research that follows these rules.