Security

Last updated: 31 October 2026

How TweakTick protects your work, your clients and their approvals. Plain English, short.

Approvals you can trust

Approve is a deliberate step. A client approves by pressing Approve and then typing a 6-digit code sent to their email. Having the link isn't enough to approve.
Hash-chained sign-off record. Each approval is written to an append-only record. Every entry includes a fingerprint (SHA-256) of the approved files and of the entry before it, so any change to past entries breaks the chain and can be detected. A check tool re-computes the whole chain.
The database enforces it. The app's database user can only add and read sign-off entries. Editing or deleting them is blocked in the database itself, not just in the app.

Your data stays in your workspace

Every query for agency data is limited to your workspace. Asking for another workspace's data returns "not found".
Internal comments are filtered out on the server before anything is sent to a client, so they never reach a client's browser or email.
Invite-only review links need a code sent to the invited person's email. Removing someone ends their access at once.

Passwords and secrets

Passwords are hashed with argon2id. We never store them in plain text.
Secrets you give us (AI provider keys, integration tokens, staging logins, SMTP passwords) are encrypted with AES-256-GCM before they're saved, and are never shown again or written to logs.
The review script's API uses short-lived tokens and an allowlist of your site addresses, not cookies.

Screenshots of websites, safely

Taking a screenshot means our server visits an address someone typed. To stop that being used to reach private systems:

Screenshots are taken in a separate, isolated container, walled off from the app and database, with a locked-down browser.
All its outbound traffic goes through a filtering proxy (Smokescreen) that blocks private, local and internal addresses, and non-web ports.
Addresses are also checked before every visit, and the proxy blocks redirects to private addresses too.
A staging login is only ever sent to the address you entered, never to a site it redirects to.

Files

Uploaded images are re-saved to strip hidden data such as location. Other files are checked to make sure they are what they claim to be.
Files are served through signed, expiring links.
Document conversion and video processing run in separate, sandboxed services.

Operations

HTTPS everywhere.
Nightly backups of the database and files, encrypted before they leave the server, with a restore test.
Error tracking that removes cookies, tokens and email addresses from reports.
A log of owner-level actions (keys, members, integrations) that can't be edited.
No analytics or tracking scripts.

Reporting a security issue

Please email [email protected] with the details and steps to reproduce. We'll reply as soon as we can and keep you updated while we fix it. Please don't access other people's data, disrupt the service, or share the issue publicly before it's fixed. Our contact details are also published at /.well-known/security.txt.

We don't run a paid bug bounty yet.

Approvals you can trust

Approve is a deliberate step. A client approves by pressing Approve and then typing a 6-digit code sent to their email. Having the link isn't enough to approve.

Hash-chained sign-off record. Each approval is written to an append-only record. Every entry includes a fingerprint (SHA-256) of the approved files and of the entry before it, so any change to past entries breaks the chain and can be detected. A check tool re-computes the whole chain.

The database enforces it. The app's database user can only add and read sign-off entries. Editing or deleting them is blocked in the database itself, not just in the app.

Your data stays in your workspace

Every query for agency data is limited to your workspace. Asking for another workspace's data returns "not found".

Internal comments are filtered out on the server before anything is sent to a client, so they never reach a client's browser or email.

Invite-only review links need a code sent to the invited person's email. Removing someone ends their access at once.

Passwords and secrets

Passwords are hashed with argon2id. We never store them in plain text.

Secrets you give us (AI provider keys, integration tokens, staging logins, SMTP passwords) are encrypted with AES-256-GCM before they're saved, and are never shown again or written to logs.

The review script's API uses short-lived tokens and an allowlist of your site addresses, not cookies.

Screenshots of websites, safely

Taking a screenshot means our server visits an address someone typed. To stop that being used to reach private systems:

Screenshots are taken in a separate, isolated container, walled off from the app and database, with a locked-down browser.

All its outbound traffic goes through a filtering proxy (Smokescreen) that blocks private, local and internal addresses, and non-web ports.

Addresses are also checked before every visit, and the proxy blocks redirects to private addresses too.

A staging login is only ever sent to the address you entered, never to a site it redirects to.

Operations

HTTPS everywhere.

Nightly backups of the database and files, encrypted before they leave the server, with a restore test.

Error tracking that removes cookies, tokens and email addresses from reports.

A log of owner-level actions (keys, members, integrations) that can't be edited.

No analytics or tracking scripts.

Reporting a security issue

We don't run a paid bug bounty yet.