Security

Sign-in is delegated to Google Firebase Authentication (Google SSO or email/password). Retroboard never sees or stores your password. API and websocket requests are verified with short-lived, signed identity tokens on every call.

Application data lives in a managed PostgreSQL database with encryption at rest, continuous backups and point-in-time recovery. All traffic is encrypted with TLS.

Private boards are only visible to their members and team members. Every API request re-validates authorization server-side — role checks (owner, facilitator, participant) are enforced in the backend, never just the UI.

Strict input validation on all endpoints, parameterized queries via our ORM (no raw SQL from user input), security headers via Helmet, and locked-down CORS.

Found something? We’d love to hear from you: security@retroboard.org. We commit to acknowledging reports within 48 hours.