Security and privacy

The main points: Documents are private by default and only reachable with a link you created. Every workspace is served from its own subdomain, so one workspace's content cannot be loaded from another's address even with a valid link. Hosted pages run under a strict security policy: a page can only fetch its own dataset, and Profusia never executes anything from a document on the server. Profusia stores no third-party credentials. It has no access to your email, your Google Drive, or your Jira, and it never asks for them. All tokens and keys are stored hashed, expire where appropriate, and can be revoked. There is a fuller public write-up at /trust, which is the page to send to a security reviewer.