Security

• You authorise us through Meta's and Google's own OAuth screens. We never see, ask for, or store your platform password.
• We request read-only scopes. A stolen Reckon token cannot spend money, change a campaign, or post anything.
• Access and refresh tokens are encrypted with an application key held outside the database, so database access alone does not yield a usable credential.
• Disconnecting an account destroys its stored token immediately. Revoking from Meta's or Google's side takes effect at the platform straight away, and we revoke our side as soon as their notification arrives.

• TLS for everything in transit; encryption at rest for the database and asset storage.
• Authentication, sessions and organisation membership are handled by Clerk. The frontend never asserts an identity: the backend derives the user and the workspace from a signed token on every request.
• Every read and write is scoped to a workspace in the API layer, so a request cannot reach another tenant's data by changing an id in the browser.
• Secrets live in a managed secret store, injected at runtime, not in the repository, not baked into images.
• The frontend never talks to Meta or Google directly and never holds a platform credential.

• Staff access to production is least-privilege, granted for a stated reason, and logged. Support access to a customer workspace is read-only, and product analytics are disabled while it is active.
• Continuous error, performance and uptime monitoring with alerting; every request carries a correlation id, which is what makes an incident reconstructable.
• Changes go through code review and an automated check suite before deployment.
• Dependencies are updated regularly, and security advisories are triaged when they appear.
• Backups are taken regularly and rotate out within 90 days, which is also the outer bound on deleted data leaving them.

Saying this plainly is more useful to a buyer than a page of unqualified assurances:

• We hold no SOC 2, ISO 27001 or comparable certification today.
• We have not commissioned an independent third-party penetration test.
• Reckon is in early access, and features change quickly.

If any of these is a blocker for your organisation, tell us at [email protected]. Knowing which control a real customer is held up by is how it gets prioritised.

Email [email protected] with what you found, how to reproduce it, and what an attacker could do with it.

We will

Acknowledge within 72 hours, keep you updated, fix what is real, and credit you if you want the credit.

We ask that you

Stay inside your own workspace, do not access or modify anyone else's data, do not degrade the service, and give us a reasonable chance to fix the issue before you disclose it publicly.

We will not

Pursue legal action against research conducted in good faith under those terms.

We do not run a paid bug bounty. For a suspected breach of your own data, write to the same address and mark it urgent; our notification commitment is 72 hours from confirming that your data was affected.