Security & Privacy

How Manuall handles your data, your passwords, and access to your workspace.

Authentication

• Secure session cookie that's hidden from page scripts, scoped to your workspace, and times out after a period of inactivity. HTTPS-only in production.
• One-way password hashing. Your plaintext never leaves your browser; Manuall stores only a strong one-way hash, and staff never see your password.
• Login takes Company Code + Email + Password, three pieces of identification.
• Repeated failed logins are automatically throttled to shut down guessing.

Password reset

Login -> Forgot Password sends a single-use reset link, good for one hour.

Protecting your account

Use a unique password from a password manager, and keep at least one other Admin so your shop never loses access. Manuall stores only a one-way hash of your password, so even staff can't read it.

Tenant isolation

• Each workspace is fully isolated. One business's data is never visible from another's.
• There is no path that can read another workspace's data while you're signed in to yours, and automated tests verify this on every release through the real request pipeline.
• Multi-business users (one email, several workspaces) switch explicitly; the session reissues on each switch.

Data in transit

• HTTPS-only in production, with HSTS.
• Webhook payloads are signed with HMAC-SHA256.
• API requests use a Bearer token; only a one-way hash of the key is stored.

Security headers

Every response carries standard browser-hardening headers, including protection against clickjacking and content-type sniffing, plus a strict Content-Security-Policy.

Antiforgery (CSRF)

Every state-changing request must carry a valid anti-forgery token, sent automatically by your browser. Webhook receivers and the portal are exempt by design.

Audit logging

• Activity Log: every create / update / delete on key records, feeding the dashboard.
• Audit Log (Business tier): field-level before/after snapshots, forensic-grade.
• Support impersonation is rate-limited and shows a banner to everyone in the workspace for its whole duration.

Privacy and GDPR-aware design

• Customer data belongs to the shop. Manuall doesn't sell it, share it, or use it for marketing.
• Right-to-be-forgotten: deactivate the customer, soft-delete the records, then permanently delete them (Trash -> permanent). You can run this end-to-end without contacting support.
• SMS opt-out is honored at the carrier level; Manuall never re-contacts a number that has opted out.
• Cookies: a secure auth cookie plus lightweight preference cookies (theme, sidebar state). No third-party tracking pixels.

Backup and disaster recovery

Manuall manages continuous backups at the hosting layer. Ask your account rep about the cadence and retention applied to your workspace.

Reporting a security issue

Found something concerning? Email security@manuall.app (or your account rep, marked confidential). We treat responsible disclosure as a partnership and will credit you publicly if you'd like.