Security

Last updated: October 13, 2026

How we protect your data

• Encryption. Every connection to Pointd Pal uses HTTPS. Slack access tokens are encrypted before they're stored, with keys we rotate.
• Only the Slack permissions we use. Pointd Pal asks Slack for the minimum set of permissions its features need, never asks for email addresses, and supports Slack's token rotation.
• Verified requests. Every request from Slack and Stripe is checked against its signature before we act on it.
• Abuse protection. Sign-in, the admin panel and webhooks are rate limited, and the admin panel sends strict security headers.
• Separated workspaces. Every query is scoped to one workspace, and automated tests check that no workspace can read another's data.
• Backups. The database is backed up every night, encrypted, to separate storage, and we practise restoring from those backups.
• Limited access. Only the people who run the service can reach production data, and admin panel sessions expire after 12 hours.
• Automated checks. Every change is scanned for vulnerable dependencies and leaked secrets before it ships.
• Deletion. Data is deleted 30 days after uninstall, or within a day when an admin asks. See our privacy policy.

Report a vulnerability

If you think you've found a security problem, email security@pointdpal.com. Please include:

• what you found and where;
• the steps to reproduce it;
• what an attacker could do with it;
• how to reach you.

We'll acknowledge your report, keep you updated, and credit you if you'd like once it's fixed. Please give us a reasonable time to fix it before telling anyone else, and don't access other people's data, disrupt the service, or use social engineering while testing. We don't run a paid bug bounty.

Our security.txt has the same contact details in a machine-readable form.

Questionnaires

If your organization needs a security questionnaire or a signed Data Processing Addendum, email security@pointdpal.com.