Security at Manifold.

Reporting a vulnerability

Found a security issue? Please email security@manifold.appwith steps to reproduce. We aim to acknowledge within 24 hours and resolve confirmed issues within 14 days. Please don't open a public issue or disclose before we've had a chance to fix.

Machine-readable contact is also published at /.well-known/security.txt.

How your data is protected

In transit

All traffic is HTTPS, terminated at Fly.io's edge with HSTS enabled. The panel itself is also gated behind authentication; marketing pages stay public.

At rest

Posts, user data, and metadata live in Postgres (Neon, us-east-1) with at-rest encryption. Generated media is on Cloudflare R2 with encrypted-at-rest defaults. Per-platform OAuth tokens are stored encrypted in the database; raw values never leave the server.

In the application

Passwords are hashed with bcrypt (cost 10). Session cookies are HTTP-only, signed, and Secure in production. JWTs are scoped per user and short-lived (1 hour). Inputs are sanitized server-side before storage and rendering.

Access control

Each Manifold brand ("site") is fully isolated — credentials, posts, assets, and team roles. Users can only see and act on sites they're explicitly assigned to. Roles range from viewer (read-only) up to superadmin (workspace-wide).

Operations

Application errors are reported to Sentry with PII scrubbed before transmission. Deploys are immutable container builds on Fly.io. The full codebase is open under Apache 2.0 — you can audit it line by line at any time.

Compliance & data subject rights

We're a small team and don't currently hold formal certifications (SOC 2, ISO 27001). The hosted service stores minimal personal data — name, email, hashed password, and content you create. To request export, correction, or deletion of your data, email privacy@manifold.app. See also the full privacy policy.

Self-hosting

Want stricter control? Manifold is open source under Apache 2.0. Self-host on your own infrastructure with your own database, storage, and access controls — none of your data touches our servers.