Security
We take reasonable steps to protect Recalen and your account. This page summarizes our approach so you know what to expect—not every technical detail.
No online service can guarantee absolute security. You are responsible for protecting your sign-in credentials and for deciding what sensitive information to store in Recalen. This page is informational and does not expand our liability beyond the Terms of Service.
Summary
| Section | What you will find |
|---|---|
| Principles | Security goals that guide our work. |
| Infrastructure | How data moves and where it lives. |
| Application security | Controls in the product and API. |
| Monitoring and response | How we detect and handle issues. |
| Your role | Steps you can take to stay safe. |
| Reporting issues | How to tell us about a vulnerability. |
Principles
Least privilege: access to production systems and data is limited to what is needed to operate the service.
Defense in depth: multiple layers—including authentication, authorization, and monitoring—reduce single points of failure.
Privacy by design: your content is scoped to your account; public routes do not expose private feeds.
Infrastructure
Traffic to Recalen uses HTTPS (TLS) in production.
Application data is stored in managed databases and object storage with access restricted to the application layer.
We use reputable providers for authentication (Clerk) so we do not store raw passwords ourselves.
Application security
Authenticated API routes require a valid session; unauthenticated requests to protected APIs receive an unauthorized response.
Content security policies and security headers help reduce common browser-side risks.
Attachments and entries are associated with the owning user; access checks are applied before serving private data.
Monitoring and response
We monitor for errors and anomalies and investigate credible reports of vulnerabilities.
If we confirm a security incident affecting your data, we will take reasonable steps to remediate and notify affected users when required by law.
Your role
Use a strong, unique password or passkey with your identity provider and enable multi-factor authentication when available.
Sign out on shared devices. Do not share account links that include session tokens.
Avoid storing highly regulated secrets (for example full payment card numbers or government IDs) unless you accept the risk of doing so in a personal productivity app.
Reporting issues
If you believe you have found a security issue, email support@recalen.com with enough detail for us to reproduce it. Please allow reasonable time for us to investigate before public disclosure.
We appreciate responsible reports and will work in good faith to address confirmed issues.