Security

Overview

This page describes the technical and organisational measures Thinkspaces uses to protect your data. We aim to be transparent about how we operate so you can make an informed decision about using the Service.

Infrastructure & Hosting

• Cloud hosting: Thinkspaces runs on Railway infrastructure in the United States. Railway provides isolated container-based deployments with private networking between services.
• Database: A managed PostgreSQL instance hosted on Railway. The database is accessible only within Railway’s private network; it is not publicly reachable.
• Object storage: User-uploaded files are stored in Railway Buckets. Bucket contents are not publicly accessible by default; all file requests are proxied through the application layer, which enforces authentication and ownership checks.
• Edge network: Cloudflare sits in front of Thinkspaces for DNS resolution, DDoS mitigation, and TLS termination at the edge.

Data in Transit

All communication between your browser and Thinkspaces is encrypted using TLS (HTTPS). Unencrypted HTTP requests are automatically redirected to HTTPS. WebSocket connections used for real-time collaboration are also encrypted (WSS).

Data at Rest

• File uploads: Objects stored in Railway Buckets are encrypted at rest.
• Passwords: User passwords are hashed with bcrypt before being stored in the database. Plain-text passwords are never written to disk or logged.
• Session tokens: Authentication session tokens are signed with a server-side secret and stored as HTTP-only cookies; they are not accessible to JavaScript running in the browser.
• Database backups: Nightly automated snapshots of the database are retained for a 30-day rolling window and are encrypted at rest.

Authentication & Access Control

• Sign-in methods: Email/password (with email verification) and Google OAuth. OAuth users do not have a password stored in the Thinkspaces database.
• Session management: Sessions are managed by NextAuth using signed, HTTP-only cookies. Sessions expire on sign-out.
• Space access: Spaces are private by default. Collaborator access is controlled via invite links; each link is scoped to a single space, can be set to expire, and only admits collaborators up to the plan’s per-space limit.
• API endpoints: All API routes verify session authentication server-side before any data is read or written. User-owned resources (spaces, items, files) are checked for ownership before access is granted.

Payment Security

Payment processing is handled entirely by Lemon Squeezy, who acts as our merchant of record. Payment card numbers, billing addresses, and tax information are entered directly into Lemon Squeezy’s payment forms and never transmitted to or stored on Thinkspaces’s servers. Lemon Squeezy is PCI DSS Level 1 certified. Thinkspaces stores only a Lemon Squeezy customer ID and subscription status.

Monitoring & Error Tracking

Thinkspaces uses Sentry for application error monitoring. When an unhandled exception occurs, Sentry receives the stack trace and request metadata (e.g. URL, HTTP method, browser agent) to help us diagnose bugs. Sentry does not receive the content of your spaces, your files, or your personal data beyond what appears in a stack trace. Error data is stored in Sentry’s EU region (Frankfurt, Germany). Standard server request logs (IP address, timestamp, endpoint) are retained for 14 days and then purged.

No Tracking or Analytics

Thinkspaces does not use analytics platforms, advertising networks, tracking pixels, or third-party behavioural tracking of any kind. The only third-party script loaded by the application is Sentry for error reporting. We do not sell or share your data for marketing purposes.

Backups & Recovery

Nightly automated database backups are stored with a 30-day rolling retention window and encrypted at rest. In the event of a confirmed data loss incident, affected users will be notified as promptly as practicable. You can also export your spaces from within the app at any time.

Data Breach Notification

In the event of a confirmed personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users by email without undue delay after becoming aware of the breach. The notification will describe the nature of the breach, the categories of data affected, and the steps we are taking to address it.

Responsible Disclosure

If you discover a security vulnerability in Thinkspaces, please report it to us privately before disclosing it publicly. We will investigate all reports promptly and keep you informed of our progress.

Email: communications@thinkspaces.app

Please include “Security Report” in the subject line. We ask that you give us reasonable time to investigate and remediate before any public disclosure.