Security
- Sign-in is Deleg8’s own: an email and a password, kept only as a salted scrypt hash. Confirm and reset links work once and run out (a day and an hour), and are stored only as a hash. Five wrong passwords lock that sign-in for a while, and nothing tells a stranger whether an address has an account.
- Your team: owners and admins can deactivate an account; its sign-ins end at once. Changes to people and roles are kept in an audit log.
- Clients see only their portal: a client’s account is refused on every internal page and route. They see their own requests and the updates you publish, never your notes, drafts or other clients.
- Deleting: you can delete a board you own (with every ticket on it) or a ticket you can change, after typing its name to confirm.
- API keys, work tokens and links are shown once and stored only as a hash. They can expire, and you can revoke them at any time. Webhooks are signed and go only to public https addresses.
- Secrets in text (anything that looks like a password, token or key) are replaced before anything is stored.
- No hidden boards: a board you have no role on answers “not found”.
- No framing: every page is sent with
X-Frame-Options: DENYandframe-ancestors 'none', so no other site can show Deleg8 inside its own page. This site runs no scripts and loads nothing from other sites. - No model keys of yours and no tracking. Deleg8 calls no AI service unless whoever runs it turns on the optional Tickets helper with their own key; it answers questions about tickets you can already see, and changes nothing.
- Rate limits apply to each sign-in, token, key and address, with repeated bad tokens refused for a minute.