Security & your data

Your workspace is private by architecture, not by policy promise.

Isolation

• One database per workspace. Your data lives in its own dedicated PostgreSQL database. There is no shared tenancy at the data layer and no cross-workspace queries.
• One workspace, its own addresses. Your workspace answers only on its own addresses: its your-org.everjust.app subdomain and any custom domain you've connected. Requests to other hosts can't reach your database.

Encryption & transport

• All traffic is served over HTTPS/TLS — including the installed mobile app and all API access.
• Workspace passwords are stored as salted hashes. The password you choose at signup is held encrypted only until your workspace is created, then deleted — never stored in plain text.
• Card details never touch our servers — checkout and billing run on Stripe.

Backups

Your workspace database is backed up before every platform update, and we keep the ability to restore it. If you ever need a restore or a copy, contact us.

Access control

• Access rights are per app, per user — see Invite your team.
• Documents adds directory-level access groups on top, so sensitive folders (HR, contracts) can be restricted to named people.
• Archiving a user disables sign-in immediately while preserving their history.
• Two-factor authentication and passkeys are available per user under Profile Settings → Account Security — see Your account & security settings.

AI agents

When you connect an AI agent, it runs as a permission-bounded user: it can do what its account can do, and nothing more. It can't grant itself the Administrator role, edit security rules, or read your stored secrets (passwords and keys come back masked). Destructive actions require a confirmation, and every action is written to an audit trail an administrator can review for 90 days.

Your data is yours

• We don't pool, mine, sell, or train on your data.
• Export records to spreadsheets from any list view, bulk-download files as a ZIP, and request a full database copy at any time — see Export your data.
• On cancellation your workspace stays available through the period you've paid for; export everything first, and we'll remove your data on request.

Reporting a concern

Found a vulnerability or have a security question? Email company@everjust.co with "SECURITY" in the subject — it goes to the top of the queue.