1. Encryption
- Everything between your device and Dovuni travels over encrypted connections (HTTPS).
- Stored data is encrypted by our infrastructure providers.
- Links you connect (Canvas, calendars, webhooks) are encrypted again before we store them; your calendar feed link is stored only as a fingerprint.
- Journal sync is end-to-end encrypted: only your devices, with your passphrase, can read it.
2. Who can see what
- Database rules ensure you can only read and change your own data.
- In teams, the database itself enforces roles and the “who can see what” settings — money fields are kept apart and only shown to people allowed to see them.
- Clients only ever see what you share in their portal.
- Study groups are invite-only.
3. Signing in
- No passwords to steal: you sign in with a one-time code sent to your email, or with Google.
- In a browser tab, you’re signed out when you close it or after 30 minutes without activity.
4. AI and secrets
- AI requests go through our servers; keys and secrets never reach your browser.
- Each AI request carries only what that feature needs, and your Personal space is never sent.
5. Payments
- Card payments are handled by Stripe; Dovuni never sees card numbers.
- Payment notifications from Stripe are signature-checked, and amounts always come from your saved invoice.
6. Reporting a problem
Found a security issue? Please send the details to security@dovuni.com and give us a chance to fix it before sharing it publicly. We appreciate it.