Security and your data
How sign-in, tokens, roles, and staff access work; what den encrypts, logs, and backs up; and what leaves a workspace only when you say so.
2 min read · On this page: Sign-in and tokens · Who sees what · Headers and origins · Storage · What leaves a workspace · Running your own den
#Sign-in and tokens
Passwords are hashed with scrypt. Sign-in is throttled per account and per address. Where den's operator has set it up, Sign in with Google signs in through OpenID Connect with PKCE: Google vouches for a verified email address, den links it to the account with that address (or accepts the invite for it), and under the invite policy nothing is created for an address den does not know. An account made that way has no password; the Tokens and devices page shows the linked Google account. A browser session lasts thirty days and records the browser it came from. Every token, whether a browser session, a laptop's device token, an API key, or a connector's grant, is 192 random bits stored only as a hash, and can be revoked on the Tokens and devices page.
A connector is authorized through OAuth with PKCE, for the workspaces you pick on the consent page.
An API key is bound the same way when you make it: the workspaces it may act in, the role it acts as (never above yours), and when it expires.
#Who sees what
Membership is the only way into a workspace. Roles limit what a member may do. Staff runs den without seeing inside workspaces, and reaches one only through an audited, reasoned, one-hour sudo session that the workspace's own audit log records.
#Headers and origins
Every page carries a content security policy and the standard transport headers. A write from a browser must come from den's own origin. The application only answers through its front, never through the bare function it runs on.
#Storage
Artifact bodies live in private, encrypted object storage; metadata in an encrypted table with point-in-time recovery and a daily backup kept for 35 days; every body ever committed is retained. Bodies are fetched through short-lived signed links den hands out per file. Nothing user-written is logged.
#What leaves a workspace
Nothing, unless a member makes a share link or marks a topic public, and both are reversible: a revoked link stops within two minutes.
#Running your own den
den is a cloud product. The same code deploys to your own account with one command for teams that need it; see Run your own den.