How AlgoSplit holds your data

Workspaces cannot see each other

Every database query in the product is issued through a single helper that asserts, at runtime, that the statement carries a predicate scoping it to one workspace. A query without one throws rather than returning rows. The underlying database method is banned outside the data-access layer by a lint rule, so the check cannot be bypassed by writing a query somewhere else, and a genuinely cross-workspace query has to be marked as such in the source with its reason.

This is deliberately a structural control rather than a code-review convention. Isolation bugs in multi-tenant products are usually one forgotten WHERE clause, and a convention does not fail loudly when someone forgets.

Passwords

Passwords are stored as PBKDF2-HMAC-SHA-256 derivations at 600,000 iterations, the OWASP recommendation, with a random per-user salt. The plaintext is never stored and never logged. The stored format records its own algorithm and parameters, so the work factor can be raised, or the algorithm replaced, without invalidating existing accounts.

Sessions are opaque identifiers in an HttpOnly, SameSite=Lax, Secure cookie, so the browser will not expose them to JavaScript and will not send them cross-site. They expire after 30 days, are renewed mid-life, and are revoked on sign-out and on password change.

In transit and in the browser

HTTPS only. Plain HTTP is redirected at the edge and again by the application, and the site is served with HSTS. The content security policy forbids inline and third-party scripts outright, there is no analytics vendor, tag manager, or advertising pixel on any page, signed in or out.

Where the data lives

The product runs entirely on Cloudflare: the application on Workers, the database on D1, sessions in Workers KV, and uploaded files and generated exports in R2. Cloudflare is the only subprocessor. There is no third-party analytics, no error-reporting vendor, no CRM, and no email marketing platform holding your data.

What is recorded

Approving a period writes an audit entry recording who approved what and when. Approved periods are immutable by design, a correction is an adjustment in a later period, never an edit to a closed one, so a statement a person was shown cannot be quietly rewritten afterwards.

Files you upload are retained so that an import can be re-read and explained later. So are the payroll exports generated from an approved period.

We never hold money

AlgoSplit calculates what is owed and exports it to your payroll system. It does not connect to a bank, hold a balance, or move a payment, so there is no payment credential in the product to lose.

What we do not have yet

These are real gaps, listed because you would otherwise have to ask:

• No SOC 2 or ISO 27001 report. The product is early and audited compliance has not been undertaken.
• No customer-managed encryption keys. Data is encrypted at rest by the underlying Cloudflare services, with keys we do not control or expose.
• No SSO or SAML. Sign-in is email and password. Two-factor authentication is not available yet.
• Deletion is a manual process. Ask, and it is done by hand; there is no self-service delete and no automated retention schedule.

Reporting something

If you believe you have found a vulnerability, email hello@algosplit.com with enough detail to reproduce it. You will get a human reply. Please do not test against another customer’s workspace or against production data that is not yours.

See also the privacy policy for what personal data is held and why.