Trust & Security

Encryption

All traffic to Morrow is encrypted in transit over TLS. Application data is encrypted at rest (AES-256) by our database provider, including automated backups. We never put your data on the public internet unencrypted.

Per-workspace data isolation

Every piece of your content is tagged with your workspace and protected by database-level row-level security — the database itself refuses to return one workspace's rows to another, independent of application code. This is enforced on every user-content table, by design, from the first migration.

Authentication

Sign-in is handled by our managed authentication provider using secure, HTTP-only session cookies. Email/password is available today; Sign in with Google, Apple, and Microsoft are planned for launch. On the roadmap: single sign-on (SSO/SAML) for organizations, which will bring your identity provider's own multi-factor and access policies.

Application security

Every input is validated against strict schemas at the edge of the system before it reaches the database. We ship standard security response headers (HSTS, no-sniff, frame protection, a locked-down permissions policy). Dependencies are monitored for known vulnerabilities and updated through automated, reviewed pull requests, and our build enforces a supply-chain policy on the dependency lockfile.

Hosting & data residency

Morrow runs on established cloud infrastructure. Your application data is stored in a managed PostgreSQL database hosted in Canada (Google Cloud), and the app is served from Vercel's edge network. Our infrastructure providers maintain their own independently-audited physical and platform security.

Audit & monitoring

Sensitive tables are wired for insert-only audit logging, and access to administrative tooling is restricted and server-side only. As we grow, monitoring and audit access will expand accordingly.

Where we are on compliance — honestly

Morrow is an early-stage, pre-launch product built by a solo founder. We are not claiming certifications we do not hold. The following are on our roadmap and are not complete today:

• SOC 2 (Type I / II) — planned as we approach enterprise readiness.
• Independent penetration test — planned before general availability.
• SSO/SAML & role-based enterprise controls — planned via a dedicated provider.
• Formal data-processing agreements, subprocessor list, and a public status page.

We would rather tell you exactly where we stand than overstate it. If your organization needs specific documentation to evaluate Morrow, reach out and we'll share what we have and our timeline for the rest.

Reporting a vulnerability

Found a security issue? Please email hello@morrowdaily.com with the details and steps to reproduce. We'll acknowledge your report and keep you updated on the fix. Please give us a reasonable chance to remediate before public disclosure.

Contact

Security or privacy questions: hello@morrowdaily.com. See also our privacy policy.