Security at Merci Apps

Last updated October 13, 2026

Your projects, clients and billing information are important business data. This page describes the protections we have in place today and what we do not claim. For privacy practices, see our Privacy Policy.

How we protect your workspace

• Separate workspaces. Every business has its own workspace. Access checks run on the server for each request, so one business cannot see another business's information.
• Role-based access. Owners, team members and customers have different permissions. Customers you invite can only see the projects, agreements and invoices you share with them.
• Protected sign-in. Passwords are stored using salted, one-way hashing, so we cannot read them. Sign-in, sign-up and password reset are rate limited and protected by reCAPTCHA to slow automated attacks. New workspaces verify their email address before they are created.
• Encrypted connections. Traffic between your browser and Merci Apps is encrypted in transit.
• Safe payments. Card payments are handled by our payment processor. Merci Apps does not receive or store your full card number.
• Activity records. Important account and billing actions are recorded in an audit log.
• Careful email. Marketing emails require your permission, include a one-click unsubscribe link, and our links are signed so they cannot be altered.

Our approach

We follow widely used security guidance, including principles from the NIST Cybersecurity Framework (identify, protect, detect, respond and recover), and apply the principle of least privilege to accounts and data access. We review and improve our controls as the product grows.

What we do not claim

Merci Apps does not currently hold third-party security certifications such as SOC 2 or ISO 27001, and we do not claim compliance with industry-specific regulations such as HIPAA. If you need to store regulated data or have a specific security questionnaire, please contact us before you start.

Your part

• Use a long, unique password and do not share it.
• Only invite people you trust and remove access when someone leaves.
• Tell us right away if you think your account has been accessed without permission.

Report a vulnerability

If you believe you have found a security issue, please tell us through the contact form with the subject "Security report". Include enough detail for us to reproduce the issue. Please give us a reasonable chance to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing. We will acknowledge reports and keep you informed.