How Picrowd protects your work

Infrastructure and encryption

Vercel serves the website and frontend. The backend and SQLite database run on Railway with persistent storage. Cloudflare R2 stores uploaded files, attachments, and generated previews.

Connections to Picrowd use HTTPS. Stored connected-tool credentials use AES-256-GCM encryption with server-side key material. Project API tokens are stored as SHA-256 hashes rather than their original bearer-token values.

Picrowd is not end-to-end encrypted. The service processes content for collaboration, search, previews, and AI. Credential encryption is not a claim that every database field is individually encrypted.

Sign-in and sessions

Sign in with a supported provider such as Google, GitHub, or Apple, or an email sign-in link. Production browser sessions use HttpOnly and Secure cookies. Session validity is checked against the current account and its revocation state.

Sessions have configured lifetimes and may renew while you are active. Do not rely on automatic sign-out after a particular number of days. Sign out on shared devices and protect the email or identity-provider account you use for Picrowd.

Project and record permissions

• Server-side checks use authenticated identity, project membership, record grants, and applicable sharing restrictions. Interface visibility alone is not an authorization boundary.
• An explicit record role can raise or lower a collaborator’s project role for that record: a project viewer can edit a specifically shared record, or a project editor can be limited to viewing it.
• Column restrictions use the intersection of applicable permissions. A record share cannot expose a column hidden from that collaborator by a project restriction.
• Project API tokens are scoped to a project and assigned rights. Keep them private and revoke them when no longer needed. They are not unrestricted account sessions.

Shared links and files

Private invitations and public links are different access mechanisms. A public record link is scoped to its record; a public project link covers its configured project. Link settings control content and actions, and can allow editing. Public does not mean read-only.

Files can use time-limited signed URLs issued after an access check. Someone with a valid file URL can use it until it expires. Revoking project or record access does not recall downloaded copies or necessarily invalidate a file URL already issued.

Review links, guest access, and visible columns regularly. For confidential collaboration, prefer invitations to named people with the minimum permissions they need.

Connected tools and AI actions

Connected tools use credentials and permissions you provide. Actions are checked on the server and recorded in tool audit history. Disconnecting an external tool disables the connection and clears stored credentials; completed actions and saved results are separate.

AI can send workspace context and tool results to an external model provider. Google-derived content has a protected classification and requires an active, approved route. Saved automations may run without asking again on each run.

Review automation instructions, allowed actions, and external accounts. Do not put passwords or access keys in ordinary records or prompts. Use dedicated connection controls for credentials.

• Privacy and AI data handling

Recovery and assurance limits

Operational backups and recovery procedures are separate from product exports. This page does not promise a particular backup frequency, retention period, or recovery time. Keep independent copies of essential information.

This overview is not a certification, independent audit report, service-level agreement, or guarantee that Picrowd meets every regulated-data requirement. Contact us for current evidence before relying on a certification, storage-region commitment, or specific compliance arrangement.

Report a security concern

Email hello@picrowd.com with “Security” in the subject. Include the affected feature, reproduction steps, approximate time, and potential impact. Remove personal data and credentials from screenshots and logs. Ask for a suitable transfer method before sending sensitive evidence.

Test only accounts and data you are authorized to use. Avoid disruption, destructive testing, and access to other users’ information. If you encounter private data unexpectedly, stop and report it without copying more than necessary to describe the issue.

We review reports and coordinate next steps. Please allow a reasonable opportunity to investigate before publishing exploit details. This channel does not promise a bounty or fixed response deadline.