Security Overview
Last updated August 2, 2026
Access control
Problem team access uses approved Google Workspace accounts and an explicit administrator allowlist. Client access uses individually issued, expiring credentials scoped to a specific client portal. Protected client requests revalidate the access record, portal status, expiration, email, and portal assignment so revocation takes effect on the next protected request.
Credentials and sessions
Client passwords are randomly generated and stored using salted scrypt-derived hashes with a server-side secret. Login attempts are throttled and recorded as security events. Application sessions expire after eight hours. Google connections require renewed authorization when the refresh grant is missing, expired, or revoked.
Data separation and validation
Client-facing API operations verify portal and project relationships before reading or changing records. Administrative actions require an approved Problem team identity. Submitted data is type-checked and bounded, client-visible links must use HTTPS without embedded credentials, and protected API responses are marked private, non-cacheable and excluded from indexing.
Transport and browser protections
Management is served over HTTPS by Vercel. Browser responses use a Content Security Policy, anti-framing and MIME-sniffing protections, restrictive referrer and permissions policies, and cross-origin isolation headers. Authenticated workspaces and APIs are excluded from indexing; only the public product, legal and trust pages are intended for search discovery. Mobile notification previews use generic copy so client or project details do not appear on a locked screen.
Infrastructure and vendors
Management uses access-controlled hosting, database, Google Workspace, email, and approved AI providers. Secrets are held in server-side environment variables and are not intentionally exposed to browser code. Provider access is limited to the operational purpose of each integration. Production data is not used in local test fixtures.
Logging, recovery, and release controls
Security-relevant access and work-history events are recorded for operational review. Releases require dependency auditing, linting, type checking, authorization and credential tests, a production build, desktop and mobile browser tests, and a successful Vercel deployment. The launch runbook includes backup verification, restoration drills, rollback, and incident ownership.
Customer responsibilities
Users should protect credentials and devices, use only their assigned account, review recipient access before sharing files, avoid unnecessary sensitive information, keep independent copies of required records, and immediately report suspected compromise. Google Drive permissions remain the source of truth for linked Google files.
Report a security concern
Send suspected unauthorized access or a potential vulnerability to info@problem.tv. Include a concise description, affected page, approximate time, and safe reproduction steps. Do not include passwords, access tokens, private client files, or destructive proof. We will acknowledge and investigate good-faith reports.
Related documents: Terms of Use · Privacy Notice