Last updated: May 2, 2026
Your drafts are personal. Here’s how we protect them.
Encryption
- In transit: All traffic to and from Writespace uses TLS 1.2+. There is no unencrypted endpoint.
- At rest: All document content, plans, databases, and account data are stored encrypted at rest by our database provider, Convex, on hardened cloud infrastructure.
Authentication
- Passwords are stored as one-way hashes (never in plain text).
- Sessions are short-lived and bound to your browser; signing out invalidates them server-side.
- Future SSO (Google, Apple) is on the roadmap. We do not currently store OAuth tokens for any third-party service unless you explicitly mint an API token.
API tokens (Bring Your Own AI)
If you mint an API token to let an agent (Claude, ChatGPT, Gemini, etc.) act on your behalf:
- Tokens are scoped to your workspace only.
- You can see all active tokens in Account → API.
- You can revoke any token in one click. Revocation is immediate.
- We log token use for your own audit trail; we do not share that log with anyone else.
Backups & disaster recovery
- Encrypted backups are taken automatically and retained for 30 days.
- We test restore procedures regularly.
- If you ever need a point-in-time restore (e.g., you accidentally trashed a critical doc), email us.
Access control
- Engineering staff do not access user content as a matter of course. Access is granted only when you explicitly request it (e.g., a support ticket about a corrupted file) and is logged.
- All staff use 2FA on every internal system.
Subprocessors
We use a small set of vendors. Each is audited for security posture before we onboard them, and each is listed in our Privacy Policy.
Vulnerability disclosure
Found a security issue? Thank you. Please email [email protected] with details and we’ll respond within 2 business days. We don’t yet run a paid bug bounty, but we’ll credit responsible disclosures publicly with your permission and send you Writespace Lifetime as a thank-you for valid findings.
Please don’t:
– Run automated vulnerability scanners that affect availability for other users
– Access other users’ accounts or content
– Post the issue publicly before we’ve had a chance to fix it
Status
If something is wrong with the Service, we post updates at status.usewritespace.com (coming soon — for now, follow @usewritespace for incident updates).
Contact
Security issues: [email protected]
Everything else: [email protected]