Security at Thisisit

In short

Read-only access to your systems

When you connect a source, Thisisit asks the provider only for read-only permissions:

• Google: drive.readonly for Drive and gmail.readonly for Gmail.
• Microsoft 365: Mail.Read for Outlook, Files.Read.All and Sites.Read.All for OneDrive and SharePoint, plus User.Read and offline_access to stay signed in.
• Xero: accounting.invoices.read and accounting.contacts.read.

The code that talks to those systems can only send HTTP GET requests, and only to each provider's own API hosts. It doesn't follow redirects with your token attached. The only other requests are the standard OAuth sign-in steps: exchanging the consent code, refreshing access and revoking it.

You choose what is read: which folders, labels, mailboxes or sites. Only workspace owners can connect, change or disconnect a source.

Encrypted secrets

Access tokens for connected systems and two-step sign-in secrets are encrypted before they are stored, with Fernet (AES-128-CBC with an HMAC-SHA256 tag). Each kind of secret has its own key, derived from the server's secret key, so a stored token can be neither read nor altered without it.

Passwords are never stored: only a salted scrypt hash. Sign-in sessions, invite links, reset links and recovery codes are stored only as hashes too.

Consent with a provider uses OAuth with PKCE, and the state value is random, single-use, stored only as a hash and expires after 15 minutes.

Workspace isolation

Each client company has its own workspace. Every document, record, source, report and alert belongs to one workspace, and every query is scoped to the workspace you are signed in to. Asking for something in another workspace by its id gets the same "not found" as an id that doesn't exist, so ids reveal nothing.

Workspaces share one database, separated by these checks in the application. Every page of the app needs sign-in; only the public pages (like this one) don't.

Quote verification

When Thisisit sorts a document, the AI must give the exact quote and page behind every value it extracts. Code, not the AI, then checks that the quote really appears in the document and that any number in the value appears in the quote. If a check fails, or the AI is unsure, the record goes to a person in the review queue instead of straight into your data.

Disconnect and revoke

An owner can disconnect a source at any time. Disconnecting deletes the stored tokens and the sync position at once. For Google and Xero it also revokes Thisisit's access at the provider. Microsoft offers no endpoint to revoke the token, so we delete our copy; to be thorough, also remove the Thisisit app in your Microsoft Entra admin centre.

Documents already pulled stay in your workspace after you disconnect, until they are deleted.

Sign-in, password reset and two-step

• After 10 wrong passwords for an account within 15 minutes (or 50 from one address), sign-in is locked for up to 15 minutes.
• Sessions are kept on the server and can be ended at any time. The cookie is HttpOnly and SameSite, and Secure in production.
• A session ends after 12 hours without use, and 14 days after sign-in in any case. Exporting or deleting data, changing who has access, and downloading the audit log need a sign-in in the last 15 minutes; otherwise you confirm your password (and two-step code) first.
• Passwords need at least 10 characters, and the most common passwords (and ones containing your email name) are refused.
• "Forgot password" sends a single-use link that lasts 30 minutes. The page gives the same answer whether or not the account exists, and requests are limited per email and per address. A reset signs you out everywhere.
• Two-step sign-in with any authenticator app (TOTP), with 10 one-time recovery codes stored as hashes. A code can't be used twice, and 5 wrong codes end the attempt. The service can require it for its operators, for workspace owners, or for everyone.
• Owners invite people by email with a 7-day single-use link, and can change roles or remove people. Removing someone ends all their sessions at once.

Audit log

Every request by someone signed in is logged once it finishes: each page or file opened, each export, question and change, and whether it was refused. So are sign-ins, wrong passwords and sign-outs. Each entry has the person, the time, their IP address and their browser.

Some entries name exactly what was touched: the document viewed or downloaded, the export, the question asked or the search, the source connected or disconnected, the invite, the role change. Others record the page's address. Document contents are not copied into the log, but the words of questions and searches are.

Owners see the log under Setup → Audit log. They can filter it by person, action, date and text, and download it as CSV. Members can't see it.

The database refuses to change any entry, and refuses to delete one, with two exceptions: entries older than the period the owner chose (90 days to 7 years, 1 year by default), and the whole log when the workspace itself is deleted. This guards against mistakes and misuse in the app. It is not a tamper-proof external log: someone with administrator access to the database server could still change it.

Export and delete

An owner can download everything in the workspace at any time, from Setup → Export and delete, as one ZIP file. It holds every record with the quote behind each value, every original file exactly as it came in, reports, entities, sources, alert rules, who has access, and the audit log. Access tokens and passwords are never included.

An owner can also delete the workspace for good, after typing its name to confirm. Deletion first revokes Thisisit's access at Google and Xero. It then removes every document, original file, record, report, source and stored token, plus invites, settings, the AI usage log and the workspace's audit log. The accounts of people who use no other workspace are deleted too. A test fills a workspace with one of everything, deletes it, and checks that no row, file or mention of it is left.

Two things remain. Encrypted backups still hold the data until they expire, within 30 days. And the service keeps one line saying that a workspace was deleted, when, by whom and how much was removed, but not its name. Text already sent to the AI provider is kept only as long as the provider's API terms allow.

Web protections

• A strict content security policy: the only script allowed on each page is the one we wrote, pinned by its hash. No third-party scripts, fonts, trackers or analytics, on these pages too.
• The app can't be framed by another site, browsers may not guess file types, and HTTPS is enforced with HSTS in production.
• Forms posted from other websites are refused. Uploads are capped in size. Website and feed sources can't reach internal addresses.
• Text written by the AI is escaped before it is shown, so a hostile document can't inject script into a report.

AI, and where it runs

• With Anthropic, search embeddings still use OpenAI when an OpenAI key is set.
• Scans can be read by OCR on our own servers (Tesseract). In the default mode a page image goes to the AI's vision model only when that reader is unsure of that page.
• Thisisit doesn't train models on your data. Every AI call is logged with its purpose, model, token counts and any error, but not the document text.

Hosting region

Thisisit is not yet running in a production region. Our planned hosting is AWS af-south-1 (Cape Town): that is under "Coming" below, not live.

Email (invites and password resets) can be sent through Amazon SES in af-south-1, which is the default region in the code.

Backups

A backup script takes a full database dump and an archive of the uploaded files, encrypts them together with AES-256, and keeps 14 days of them, with a second encrypted copy off the server. Once our production server is live, it will run every night. A restore check restores the newest backup into a scratch database and compares the row counts and files with what was backed up.

Sub-processors

These companies may process your data on our behalf. The systems you connect (Google, Microsoft, Xero) are yours, not our sub-processors.

Our operator agreement under POPIA section 21 lists the same companies and the basis for sending data abroad.

Coming

Not built yet. We list these so you know what is and isn't in place today.

• Hosting in South Africa: the app, database, files and backups in AWS af-south-1 (Cape Town). Planned, not live.
• Two-step required by a workspace's own owner (today the service sets it by role, for every workspace).
• An audit log kept outside the main database, so not even a database administrator could change it.
• Shared rate limits across several servers (today they are per server).
• An independent penetration test.

Certifications and contact

Thisisit holds no security certifications (such as ISO 27001 or SOC 2) and doesn't claim any. Ask us anything your IT or compliance team needs, and we'll answer in writing.

To report a security problem, or for questions about your data, contact us through the form on our home page.