Security
How access and data are handled.
Your workspace holds project, time, and invoice records. Here is how SOWLedger handles access to those records and connections to other services. These controls are not a claim of formal security certification.
Report a security concern
Tell us what you found, where it happened, and how to reproduce it safely. Remove passwords, API keys, tokens, payment details, and private customer data from your report.
Contact securityWorkspace access
Workspace membership and role determine which records and actions a person can access. API keys belong to one workspace and have their own permissions.
API keys
Full keys are shown only when created or rotated. SOWLedger stores a hash, supports expiry and revocation, and records recent key usage.
Subscription billing
Workspace owners manage subscriptions through Stripe checkout and the billing portal. Public API keys cannot change a workspace subscription.
Export checksums
CSV and JSON downloads include a SHA-256 checksum so you can check whether a file has changed. Review exports before sharing them; they contain workspace data.
Request authentication
API v1 requests require a valid key and the required permissions. Stripe webhook requests are checked against their signature before processing.
Connected services
Stored integration credentials are encrypted. Owners and managers control the workspace's provider connections; raw provider tokens are not shown in the app.
Keep sensitive actions in the app
Manage subscriptions, invitations, and workspace settings while signed in with the required role. These actions are not available through public API keys.