Security overview
We take security like it's our day job
Engineering teams trust MARINA with their most sensitive signals — what their developers shipped, who's blocked, what they did during the day. Here's exactly how we protect that.
Encryption everywhere
TLS 1.3 in transit. AES-256-GCM at rest (Neon-managed). Browser-to-server traffic uses HSTS with a 1-year max-age.
Agent + API bearer tokens are 32 random bytes, stored only as SHA-256 hashes. Plaintext is never persisted server-side. The Mac agent encrypts its local token via macOS Keychain (Electron safeStorage).
Pairing codes: 40-bit entropy, single-use, 10-minute TTL, hashed at rest.
Tenant isolation
Every read from user-level data tables is scoped to the org's active-membership window. A teammate in two orgs can never leak data across them, even on shared GitHub events.
Every API route runs through `requireMembership(orgId, minRole)` before touching data. Integration tests verify boundaries hold on every deploy.
Privacy-respecting tracking
The Mac/Windows agent samples application focus every 30s. Window titles are off by default — opt-in per org. No keystroke logging, ever.
Disclosed-randomized screenshots: 2–4 per active hour, with a visible flash. Each is auto-deleted after 48 hours; only AI-derived labels persist.
Tracking only runs between punch-in and punch-out. Pausing is a single click. Workplace-surveillance consent is recorded with timestamp + IP + policy version on agent install.
Access control + audit
Three roles: owner, manager, member. Members never see other members' data. Managers see the team dashboard, decide leaves, view analytics. Only owners can change org settings or remove members.
Single Sign-On with Google Workspace and Microsoft 365 on the Scale tier. SCIM provisioning on request.
Every privileged action — leave decision, member removal, role change, billing change, settings change — writes to an immutable audit log retained for 7 years.
Vulnerability handling
Submit security reports to thetanishgarg@gmail.com. We acknowledge within 24 hours and patch high-severity issues within 7 days.
Automated dependency scans on every commit (Dependabot + npm audit). Annual penetration tests.
Compliance
Digital Personal Data Protection Act 2023 (India): compliant by design. Data Principal rights (access, correction, erasure) are self-service in the app.
SOC 2 Type 1 audit in progress with Sprinto · target Q4 2026.
India-region data residency available on the Scale tier (Neon Mumbai).
Need our DPA, SOC 2 letter, or sub-processor list?
Email thetanishgarg@gmail.com. We typically respond within one business day. Self-serve downloads coming Q1 2026.