Security

Your team controls who joins its workspace and what it publishes. This page explains the protections behind those choices, with technical details for the people reviewing your software.

What this means for your team

• Choose who can administer the workspace, contribute records or view them.
• Limit private entries to their author and your organization’s admins.
• Publish selected information through the optional website feed. Internal notes stay out of that feed.
• Review access to sensitive records and export your tracker as an admin.

Contact us with your security requirements. We can discuss how these controls fit your organization’s review.

Technical review: encryption and key management

Sensitive text such as meeting notes, reasons for decisions and next actions uses a separate encryption key for each organization. The application manages and unlocks these keys so it can show records to authorized members of your team. These are application-managed keys, not keys held exclusively by customers.

Organization-specific encryption adds protection alongside access controls. It prevents encrypted text from being opened with another organization’s key; it is not a guarantee against every software or authorization error.

Encryption details

• Each organization has its own randomly generated AES-256 data key. It is stored only in wrapped (encrypted) form, under a master key held as a platform secret, never in the database in the clear.
• Internal notes, meeting and call records, people not in your directory, reasons for decisions and stance changes, “why it matters” summaries, next actions, and campaign notes are encrypted with that key using AES-256-GCM before they are written.
• Data travels over HTTPS (TLS) only.

Older records created before encryption was introduced may remain unencrypted until they are saved again. Ask us about migration status for your organization.

Some fields stay readable to the application so they can be searched and counted: bill positions and priorities, which people a meeting involved, and where a legislator stands on a bill. They are protected by the access controls below. Selected bill positions and summaries can appear in your public feed when you choose to publish them.

Separation between organizations

Requests for organization records are scoped to the signed-in person’s organization. Automated tests check that one organization cannot read, change or delete another's records, and that one organization's encrypted data cannot be read with another's key.

Access

• Sign-in is handled by Cloudflare Access, with one-time email codes or a Google account. We verify the signed sign-in token on every request.
• Roles: admins, members, and read-only viewers. Entries marked private are visible only to their author and your admins.
• Exports of your tracker are limited to admins.
• An audit log records who viewed, exported, created or deleted sensitive records, and when.

What we don't collect

• Campaign metrics store aggregate totals rather than supporter contact lists. People records and free-text notes can contain personal information your team enters; include only what your work needs.
• No analytics or advertising scripts in the app or on this site, and the app loads no third-party scripts at all. The only outside script on this site is Cloudflare Turnstile, a bot check, on the demo booking page. Fonts are served from our own domain.
• The public feed shows only what you choose to publish: bill facts, your published positions and summaries, and campaign totals you mark public.

Infrastructure

Statehouse Signal runs on Cloudflare (Workers, D1 and R2). The app sends a strict content security policy that allows only its own scripts.

Planning a security review?

Send us your requirements for data retention, backups and recovery, support access and security documentation. We can discuss them with your team before onboarding.

Reporting a problem

If you believe you've found a security issue, please contact us.