Security

This page says how Issuelane protects what you put in it, and it is as honest about the gaps as about the rest. Issuelane is in preview and has no certification of any kind, so nothing below is a badge. It is a description of what the code does.

How you sign in

With your email address and a password, through a link sent to your address, or, if you choose it, with Google. A password is kept only as a salted hash, never as itself. Sign-in runs on Issuelane’s own servers, and your session is a cookie in your browser that scripts on the page cannot read.

Who can see your work

Everything in Issuelane belongs to a workspace, and every read is scoped to the workspaces you are a member of. Being removed from a workspace ends your access to it at once. Agent tokens are held to the same scope and are refused outright on anything to do with an account.

In transit, and in the browser

Every connection is over HTTPS and every response tells the browser to keep it that way. The same responses stop another site putting Issuelane in a frame, stop the browser guessing at content types, and limit what the page is allowed to load. A content security policy is enforced: the browser refuses content from places the app does not use, and reports what it refused to us.

Files you upload

Attachments and exports go to private storage that nothing public points at. When you press download we mint a link that works for a few minutes and then stops working. No long-lived file link is stored anywhere.

Abuse

Requests are rate limited per account and per address, so one client cannot flood the service, and sign-in and invitation paths are held to tighter limits than the rest.

Nothing is watching you

There is no advertising in Issuelane and no profiling. The only analytics is Cloudflare Web Analytics, which sets no cookies and loads only if you allow it in the cookie choices banner. The providers that see your data are listed on the subprocessors page, all of them.

Getting your data out, and getting rid of it

You can ask for a copy of everything we hold about you from profile settings. It is built in the background, it is one JSON file, and the file is deleted 7 days after it is made. You can delete your account from the same screen. What that does, exactly, is set out in the Privacy & Cookie Policy.

What is not in place yet

• No certification. There is no SOC 2 report and no ISO 27001 certificate, and neither is in progress.
• No independent test. Nobody outside the team has tried to break in on our invitation.
• No published backup and restore procedure. Until there is one and it has been run, do not treat Issuelane as the only copy of anything you cannot lose.
• No availability commitment. There is no uptime target and no service level agreement while the service is in preview.

Telling us about a problem

If you find something, write to support@cublya.com. Tell us what you found and how to see it happen. We will confirm we received it, and we will not take action against anyone who reports something in good faith and does not go further than they need to in order to show it. There is no reward programme.

If you need this in a contract, the data processing agreement page says what such an agreement covers and how to ask for one.