Security

Last updated: October 2026. Tickbase is pre-launch; these are our operating security commitments, not marketing claims.

How we protect the service

• Authentication: Tenant API keys are required on every job, run, key and account endpoint; only the SHA-256 hash of each key is stored. Treat your key like a password — rotate immediately if exposed. The only unauthenticated endpoints are the health check, the Stripe webhook (protected by Stripe's own signature), and the one-time claim and free-signup endpoints (abuse-capped and rate-limited).
• Transport: TLS everywhere in production; the API never accepts plaintext credentials.
• Secrets: all configuration via environment variables. Secrets are never hardcoded, never committed to git, never written to logs.
• Logging: structured logs record metadata (timestamps, counts, error codes) — never message bodies, API keys, or credentials.
• Least privilege: production services run as non-root users in minimal containers.

What we ask of you

• Keep API keys server-side; never embed them in client-side code or public repos.
• Use a unique key per environment and rotate on personnel changes.

Reporting vulnerabilities

Email don+tickbase@lifeofmorr.com(placeholder address — being set up) with details. We aim to acknowledge within 48 hours. Please don't publicly disclose before we've had a chance to fix.

What we don't claim

We have not completed a SOC 2 audit or penetration test yet. When we do, the reports and dates will be listed here.