Security

Aligne supports email and password sign-in and Google single sign-on. Authentication is handled by a managed identity provider that stores password hashes using modern algorithms; we never see or store passwords in plain text. Email confirmation is required before new accounts can sign in, and password resets are delivered through time-limited links.

Access to workspaces and flows is governed by membership and role. People can only access workspaces they belong to and content they have permission to access within those workspaces. Server-side authorisation checks are performed on every request, so hiding UI is never the only protection — the data layer enforces the same rules.

Aligne uses defined roles such as owner, admin, creator, and viewer. Viewers cannot modify flows, nodes, or communication content. Where supported by the workspace plan and permissions, viewers may participate in collaboration features such as commenting. Creators and admins have edit rights scoped to their workspace. Owners can manage membership and workspace settings. Permission boundaries are enforced consistently across the application and backend.

Workspace data is stored in a managed database with row-level security policies that scope access to authorised members. Traffic between your browser and the service is encrypted in transit using TLS, and data is encrypted at rest by our infrastructure providers. Backups are managed by those providers as part of their standard offering. Aligne relies on established managed infrastructure providers for services such as authentication, hosting, databases, and email delivery.

We follow standard engineering practices including code review, environment separation between development, preview, and production, and least-privilege access for administrative tooling. Aligne records appropriate application, authentication, and operational events to investigate issues, maintain platform health, detect abuse, and support security investigations.

Aligne is an early-stage product. We do not currently hold SOC 2, ISO 27001, HIPAA, or other formal compliance certifications, and we do not yet conduct third-party penetration tests on a scheduled basis. We will update this page when that changes.

We appreciate reports from security researchers and customers. If you believe you have found a security issue in Aligne, please:

• avoid accessing or modifying data that does not belong to you;
• avoid testing techniques that could degrade service for other users;
• give us a reasonable opportunity to investigate and remediate before any public disclosure.

Please send security reports to support@getaligne.com.