Security
How we protect what you put here.
Serene Studio is a privacy-first productivity platform for small and midsize businesses — branded email, files, contacts, calendar, chat, newsletters, and a company website, under one login and one bill. This page explains, plainly, how we protect the data you trust to it.
Where something is designed but not yet shipped, it appears under a calm “On our roadmap” marker. We would rather tell you plainly what is built and what is coming than blur the two. Last reviewed 18-Jul-2026.
Our commitments, in plain terms
Your data is yours
We do not sell it, share it with advertisers, or feed it to third-party analytics. There are no trackers, ad SDKs, or session-replay tools anywhere in the product — enforced by written repository policy, not just good intentions.
Passwordless-first identity
The platform is its own identity authority. Sign-in is built around passkeys, magic links, and verified external providers — with layered MFA and full session revocation.
Tenant isolation by design
Every business on the platform is scoped at a server-side authorization choke point. Data rows carry tenant identity; cross-tenant access is refused at the database query layer, not filtered in the UI.
A small, auditable surface
The platform runs on Cloudflare's edge with TLS on every connection, encryption at rest, daily automated database backups, and an audit log of identity and administrative events.
Disciplined engineering
Every change reaches production through a pull request with required automated checks: type checking, tests, secret scanning, and static analysis. Security patches ship same-day.
A small company, on purpose
We treat our size as a security feature: the people who write this platform are the people who answer for it. Where we have not yet earned a claim, we say so below rather than implying otherwise.
Identity and authentication
Serene Studio maintains its own user records. External identity providers — Microsoft, Google, LinkedIn, GitHub — act as authenticators only: they can prove you control an account, but they are never the source of truth for who you are on the platform. A central identity host, auth.onserene.io, brokers sign-in across platform hostnames, so tenant-branded domains never handle raw credentials themselves.
Passwordless-first sign-in
- Passkeys (WebAuthn). Hardware-backed, phishing-resistant credentials — the strongest option we offer, and the one we encourage.
- Magic links. Single-use, expiring sign-in links. Redemption happens on an explicit user action, not on the link being fetched — so corporate mail scanners that pre-open links cannot consume them on your behalf.
- External providers. Microsoft, Google, LinkedIn, and GitHub — under the explicit-linking rule below.
Explicit linking, never email matching
Many platforms silently attach a new “Sign in with X” identity to an existing account because the email addresses match — a known account-takeover vector. We deliberately do not. An external identity is bound to a Serene Studio user only when an already-authenticated user explicitly links it from their own settings. This is enforced in the identity-linking code path itself, not by convention.
Multi-factor authentication
MFA is available in layers: emailed one-time codes at sign-in, authenticator-app codes (TOTP), and a fixed set of single-use backup codes. Only a one-way hash of each backup code is ever stored; the cleartext exists only in the moment it is shown to you. Authentication surfaces are rate-limited against guessing.
Sessions you can actually revoke
Sessions are first-party, host-only cookies using the browser's strictest cookie class, backed by a server-side session store. Revoking a session — or all of a user's sessions after a suspected compromise — deletes the server-side record, and the platform refuses the stale cookie from then on. Identity-significant events are written to an audit log, and a security-notification sweep checks for tripwire conditions every five minutes.
Tenant isolation and encryption
Every business on Serene Studio is a tenant, and isolation is enforced server-side, in code paths every request must pass through. Requests resolve to exactly one tenant context before any module logic runs. Authorization decisions go through a single capability resolver — one choke point, not per-page ad hoc checks — and core data tables carry a tenant identifier, so queries are scoped to the caller's tenant at the database layer.
Sharing outside a tenant happens only through explicit, revocable mechanisms — for example, guest file links, which can be revoked at any time — never through implicit visibility. Per-tenant resource controls, including storage quotas, apply on top.
Encryption
- In transit: TLS on every connection, everywhere, always.
- At rest: all platform data stores are encrypted at rest by Cloudflare as the infrastructure provider.
- Secrets and connector credentials a tenant supplies are held in dedicated encrypted vault modules, never as plaintext rows.
Data protection and privacy
These commitments are structural — several are enforced by written repository policy that blocks the relevant software from ever being added.
- No third-party trackers. No analytics SDKs, no ad SDKs, no session-replay tools, no third-party beacons — anywhere in the product, including admin surfaces.
- Self-hosted fonts. Font CDNs are a tracking vector, so fonts ship with the application.
- No selling or sharing of data. We do not sell customer data, share it with data brokers, or use it for advertising. Full stop.
- Data-footprint minimization. By standing engineering rule, logs reference entities by internal ID, not personal information; identifiers are hashed where a hash suffices; personal data is rendered only in the authenticated view that needs it; features collect only what they actually need.
- Sanitized rendering. Inbound email HTML is sanitized and displayed inside sandboxed per-message frames, limiting what hostile mail content can do in your browser.
- Retention with a broom. A daily retention sweep removes expired data — expired sessions, short-lived tokens — rather than letting it accumulate. Chat retention is tenant-configurable.
- Children. Serene Studio and our websites are not directed at children under 13, and we do not knowingly collect personal data from children under 13. Where we learn we hold such data, we delete it.
Our Privacy Policy, Terms of Service, and Content Policy are published here and reflect how the platform actually behaves.
Platform and pipeline
Serene Studio is built natively on Cloudflare's developer platform: Workers for compute, D1 for structured data, R2 for files, KV for short-lived operational state. There are no long-lived servers to patch, no SSH ports to expose, and no shared virtual machines holding customer data. A dedicated backup process exports the primary database on a daily schedule to durable object storage — automated, not operator-remembered.
Security in the pipeline, not just in the product
- PR-only production. The production branch cannot be pushed to directly; every change arrives via a pull request with required automated checks — type checking, tests, secret scanning, static analysis — and dependency monitoring across repositories.
- Same-day security patches. By standing rule, security patches to dependencies are applied immediately — not batched, not deferred.
- Approval-gated deploys. Merging to production is gated: an operator must explicitly authorize each item before automation will merge it.
- Integrity-verified migrations. Database migrations are applied through a controlled pipeline that verifies a cryptographic hash of the SQL — a mismatch is refused, never applied — and records each migration atomically in an applied-migrations ledger.
- Drift detection. A scheduled check verifies that what is deployed matches the repository, catching silent drift between what is reviewed and what is running.
Disaster recovery is a redeploy-plus-restore exercise, not a rebuild-from-memory exercise: infrastructure is declared in version-controlled configuration, the database is restorable from daily exports, and application code redeploys from the repository. The platform inherits Cloudflare's global anycast network, DDoS absorption, and edge redundancy.
Where we stand on compliance
We will be straightforward here, because trust pages that imply certifications a company does not hold are exactly the pattern we built this platform against.
What is true today: we are a U.S. limited liability company; our privacy, terms, and content policies are published and reflect how the platform actually behaves; and the controls described on this page — tenant isolation, encryption in transit and at rest, audit logging, backup automation, CI security gates — are operating controls, verifiable in our engineering practice, not aspirations.
What we do not have yet: we have not undergone a SOC 2 examination, and we do not claim ISO 27001, HIPAA, or PCI DSS. The platform does not process payment card data directly — payments are handled by a dedicated payment processor — and is not offered as a HIPAA-covered service. We apply data-minimization and deletion principles globally because they are good practice, but we have not yet completed a formal GDPR readiness program.
If a certification or attestation matters to your evaluation, ask us — we would rather discuss our actual controls with your team than hide behind a badge.
Reporting a vulnerability
Email privacy@serenecreations.iowith “SECURITY” in the subject line, and include enough detail to reproduce the issue. We commit to acknowledging good-faith reports promptly, keeping you informed of remediation, and not pursuing legal action against good-faith research that respects user data and avoids service disruption.
Privacy questions and data requests go to the same address. This page is reviewed and updated as the platform evolves.