How Logless is built to be secure

The intended architecture is read-only, metadata-only access. Today that's requested through GitHub's classic `repo` OAuth scope, which is broader than ideal: classic scopes have no narrower grant for reading private-repository metadata. Logless's code never uses that scope to fetch file contents or diffs, and never writes to your repositories. The proper fix is a fine-grained GitHub App (contents: none, metadata: read), which is planned but not yet built.

Commit, pull request, review and issue metadata: titles, timestamps and types. The titles become the first draft of each entry's description, which the person can edit before approving. Repository names are stored only so an admin can map repositories to internal projects; they aren't shown on timesheets, to managers, or in exports. File contents, diffs and source code are never fetched.

Traffic is encrypted in transit (TLS/HTTPS, with HSTS). GitHub access tokens are encrypted at rest with AES-256-GCM, using a key derived from a server-held secret, and are never sent to the browser. This is not end-to-end encryption: Logless's servers can decrypt data to build your timesheet. A separate envelope-encryption module (per-record data keys wrapped by a key-encryption key) exists as a tested foundation for customer-managed keys, but it isn't wired into any live storage yet. See the roadmap below.

Every customer-owned record (clients, projects, timesheets, activity) is scoped by company at the query level, enforced in every server action, not just the interface. Automated tests check that one company's data can't be read or written through another company's ID. Roles (admin, manager, member) restrict settings, repository mapping and team-wide views, and are re-read from the database on every request.

Sign-in is rate-limited per IP address and per email, and sign-up and the early-access form per IP address. Counters are stored as one-way hashes, never raw IP addresses or emails, and expire within an hour. The early-access form has a hidden spam trap. Every response carries security headers that block framing, content-type guessing and unneeded browser features.

AI is optional and switched off today; fixed rules produce the full draft timesheet without it. If AI summaries are enabled, only an anonymised signal is sent: activity counts, a time window and an opaque internal project label, never a commit message, pull request title, repository name or file content. AI output is never written straight to the database; it goes through the same validated pipeline as everything else. Zero-data-retention AI processing is a goal, not a current claim.

Detected activity metadata is deleted automatically after 180 days by a scheduled job. Approved timesheets are your records, kept independently of the activity that produced them. Disconnecting GitHub revokes Logless's access on GitHub and deletes the stored token; it doesn't delete already-approved timesheets.

Not implemented. Every change already goes through company-scoped, role-checked server actions, but there's no dedicated who-changed-what-when trail yet. It's on the roadmap, not claimed here.

Nothing under Next or Later is live yet. It's what we're designing towards, not current capability.