Security
Trust, checked at every ring.
Before a request touches your project work it passes four checks: who you are, which project you’re on, which apps you hold, and what you may do with this item. Checked on each request, not just at sign-in.
The same path, every time
The assistant, API tokens and MCP connections take the same road and pass the same checks. Each acts as the user who owns it — never more. A token’s scope can narrow that further.
The control register
What stands behind the work.
What is in place today, in plain words. We don't hold a security certification yet, and we don't claim one.
- 01
Permissions, down to the project
- Workspace roles plus per-project membership — clients and contractors see only the projects they're on
- Per-app permissions, checked on each request to project work, not just at sign-in
- Apps can be enabled per project, so teams only see what they use
- 02
AI that works within your permissions
- The built-in assistant, API tokens, and MCP connections all act as the user who owns them — never more
- Token scopes narrow access further; a token can hold fewer permissions than its owner
- Before the built-in assistant changes your boards, tickets, time entries, or comments, it shows you the change and waits for your approval. Drafts it writes and drawings it adds to an open canvas appear right away and can be undone
- Tools you connect through MCP or the API act directly, as you — grant them only the scopes they need
- 03
Sign-in built to resist takeover
- Sign in with an emailed link or code, a passkey, a supported single sign-on provider, or an optional password
- Optional passwords must be at least 15 characters, are screened against known breached passwords, and are stored only as strong one-way hashes
- Two-factor authentication is available to everyone and always required for Pinboard staff with admin access
- Workspace admins can require two-factor for project admins; it is off until a workspace turns it on, and single sign-on that enforces two-factor also counts
- Two-factor secrets are encrypted at rest; email sign-in links and recovery codes are stored only as one-way hashes
- 04
Encryption in transit and at rest
- Connections to Pinboard are encrypted with TLS, and browsers are told to always use HTTPS
- The production database, its backups, and uploaded files are encrypted at rest with cloud-managed keys
- API tokens shown once and stored only as hashes
- 05
Hardened and monitored
- The production database sits on a private network with no public endpoint; our team reaches it only through managed admin sessions, not open SSH
- Project files and ticket attachments are served through short-lived signed links; images, icons, and preview thumbnails are served from public links so they load quickly
- API traffic passes through an edge firewall with DDoS protection, plus rate limiting in the app
- An enforced Content-Security-Policy and standard security headers on the web app
- Structured audit logs for sign-in events and role changes; desktop apps code-signed and notarized
- 06
Preparing for SOC 2
- Controls documented and mapped to the SOC 2 Trust Services Criteria. We're preparing for an independent audit; we don't yet hold a SOC 2 report or certification
- Code reaches our main branch only through a pull request that passes automated tests, secret scanning, and static security analysis
- We've tested restoring the production database from backup, and reviewed who holds access to production infrastructure
Responsible disclosure
See something we should know?
We welcome good-faith vulnerability reports and credit researchers who ask.
- To
- hello@pinboard.ai
- Subject
- Security report
- Include
- What you found, how to reproduce it, and whether you’d like credit.
Keep every project with the people on it.
Request early access and we’ll email you when your workspace is ready.
Checking your browser…
Paid early access. We'll contact you with availability and next steps.