Security

What we actually do — and what we don't claim.

What we do

• OAuth credentials live in environment variables, never in code or logs.
• The v0.2 SaaS adapters will use least-privilege read scopes; the engine never writes to your source.
• Backups should land on storage separate from the source (S3, B2, NAS) — point BACKKEEP_BACKUP_ROOT at a mounted bucket.
• We are not SOC 2 certified. The drill report is the proof we offer instead of a badge.

What we don't claim

We are not SOC 2 certified, not ISO 27001 certified, and we don't use the phrase "military-grade encryption". If we name a cipher, we name the key management next to it. Security claims on this page describe the software as shipped — verified in the product repo, not in a badge.

Report an issue

Found a vulnerability? Email don+backkeep@lifeofmorr.com with details. We respond to good-faith reports promptly and don't pursue researchers who follow responsible disclosure.