Security

Overview

Security is foundational to Researchful. We handle research data, draft manuscripts, source libraries, and collaboration recordings — all of which are sensitive, often proprietary, and often subject to institutional data policies. This page describes the technical and organizational measures we take to protect your data.

If you are an institution or organization evaluating Researchful for deployment and need a more detailed security dossier, SOC 2 scope, or signed DPA, contact security@researchful.app.

Encryption

• In transit — all traffic between your browser and Researchful is encrypted with TLS 1.3. We do not support legacy protocols (TLS 1.0, 1.1, or SSL). HSTS is enabled with includeSubDomains and preload.
• At rest — all data stored in our database and object storage is encrypted with AES-256. Encryption keys are managed by the cloud provider's KMS and rotated on a regular schedule.
• Backups — encrypted with the same AES-256 standard. Backup encryption keys are separate from production keys.
• Meeting recordings — encrypted at rest and accessible only to the host who started the recording. Recording URLs are signed and expire after 7 days.

Authentication and session management

• Password hashing — passwords are hashed with bcrypt using a per-user salt and a cost factor of 12. We never see or store plaintext passwords.
• Session cookies — authentication cookies are marked HttpOnly, Secure, and SameSite=Lax. Session IDs are 32 bytes of cryptographic randomness.
• Session expiry — sessions expire after 24 hours of inactivity or 7 days absolute, whichever comes first. Re-authentication is required for sensitive actions like changing email or password.
• Rate limiting — sign-in, sign-up, and password-reset endpoints are rate-limited to 5 requests per second per IP. AI agent endpoints are rate-limited to 20 requests per minute per user. Repeated failed sign-in attempts trigger exponential backoff and account lockout.
• CSRF protection — every state-changing request (POST, PUT, PATCH, DELETE) requires a CSRF token that is validated against the session cookie.
• Two-factor authentication — admin accounts require 2FA. We are rolling out 2FA for all users in 2026.

Access control

• Least privilege — engineers and support staff have access only to the systems and data necessary for their role. Production database access is restricted to a small number of senior engineers and is logged.
• No routine access to user content — we do not read your projects, drafts, or sources as part of normal operations. We access user content only when you explicitly request support and grant us permission, or when required to investigate a security incident.
• Just-in-time access — production access is granted on a just-in-time basis with a documented reason, time-boxed, and reviewed monthly.
• SSO for staff — all internal tools (source control, dashboards, monitoring) require SSO with hardware-key-backed 2FA.

Audit logging

Every sensitive action — sign-in, password change, project share, agent invocation, admin action — is logged with timestamp, actor, IP address, and request metadata. Logs are stored in append-only storage, retained for 365 days, and reviewed for anomalies.

For ResearchFlow users, every AI agent action is also logged with input hash and output hash, visible to the project owner and any collaborators. This is the audit trail that powers the integrity report.

Infrastructure security

• Cloud hosting — Researchful runs on major cloud providers with ISO 27001, SOC 2 Type II, and ISO 27017 certifications. We select regions based on data residency requirements.
• Network isolation — production databases and internal services are not directly internet-accessible. All access is mediated through a bastion host with audit logging.
• Patch management — security patches are applied within 7 days of release for high-severity vulnerabilities and within 24 hours for critical vulnerabilities.
• Dependency scanning — all dependencies are scanned for known vulnerabilities on every commit and on a nightly schedule. Vulnerable dependencies are upgraded or replaced.
• Container security — container images are scanned on build, signed, and verified at deploy time. We run containers with the minimum necessary capabilities.
• Secrets management — all secrets (API keys, database credentials, signing keys) are stored in the cloud provider's secrets manager. No secrets are committed to source control.

Vulnerability disclosure

We welcome responsible disclosure of security vulnerabilities. If you believe you have found a vulnerability, please email security@researchful.app with a description of the issue, steps to reproduce, and any proof-of-concept. We commit to:

• Acknowledging receipt within 48 hours.
• Providing an initial assessment within 5 business days.
• Notifying you when the vulnerability is fixed.
• Crediting you on our security acknowledgments page (with your permission).

Please do not access or modify data that does not belong to you, do not perform denial-of-service testing, and do not publicly disclose the vulnerability until we have had a reasonable time to remediate. We will not take legal action against researchers who follow responsible disclosure guidelines.

Incident response

We maintain an incident response plan that defines roles, communication channels, and timelines for security incidents. In the event of a confirmed breach:

• Our priority is to contain the incident and restore service integrity.
• We conduct a forensic investigation to determine scope.
• We notify affected users within 72 hours of confirming a breach that affects their personal data, in accordance with GDPR Article 34.
• We publish a post-incident report within 30 days, describing what happened, what we did, and what we changed.

Subprocessors

We use the following categories of subprocessors to operate the Service. A current list of named subprocessors is available on request from legal@researchful.app:

• Cloud infrastructure — hosting, compute, storage, and database services.
• Email delivery — transactional and marketing email.
• Error monitoring — application error tracking and alerting.
• Product analytics — aggregated, pseudonymous usage analytics.
• AI model providers — OpenAI-compatible and Gemini providers for agent execution. Provider configuration is visible to admins in the admin panel.

We require all subprocessors to sign data protection agreements and to maintain security certifications appropriate to the data they process. We notify users 30 days before engaging a new subprocessor that processes personal data.

Contact

For any security question, concern, or vulnerability report, contact security@researchful.app. For data protection questions (GDPR, FERPA), contact privacy@researchful.app.