Security

01 Infrastructure

Nocthink runs on Cloudflare: the application on Workers, records in D1 and files in R2. Traffic is encrypted in transit with TLS, and Cloudflare encrypts stored data at rest. Nightly database backups are kept in a separate private R2 bucket under that same at-rest encryption; they are not encrypted again by Nocthink.

02 Separation between organizations

Every record belongs to one organization, and every request is checked against the organization you are signed in to. One organization cannot read another’s data.

03 Accounts and sign-in

• Passwords are stored only as salted hashes.
• Two-factor authentication with an authenticator app is available to every member, with single-use backup codes.
• The session cookie is HttpOnly and SameSite, so page scripts and other sites cannot use it.
• Sign-in and other sensitive actions are rate-limited, and public forms are protected from bots by Cloudflare Turnstile.

04 Access and accountability

What each member can see and do follows the role an owner gives them. Changes to records are written to audit logs with the person, time and address, which owners can review.

05 Retention and deletion

When an owner deletes an organization it closes at once and is permanently removed 30 days later. Copies already in database backups and point-in-time history are not edited; they expire within a further 30 days. Details are in the Privacy Policy.

06 Report a vulnerability

If you find a security issue, email hello@nocthink.com with the steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and do not access data that is not yours. We will confirm receipt and keep you informed.