Security you can trust
Afterlight is built with security and privacy at the core — from encryption at rest to audit logging and server-side permission checks.
Encryption
Vault content, future messages, and business credentials are encrypted with AES-256-GCM using per-record keys derived from your application key.
Authentication
Passwords hashed with Argon2id. Sessions use HttpOnly cookies with SameSite protection.
Private file storage
Uploads stored outside the web root with authenticated download endpoints and ownership checks.
Billing security
Stripe handles all payment data. Webhook signatures are validated server-side; plan prices are never trusted from the browser.
Audit logging
Significant actions — including billing changes — are recorded with metadata for review.
CSRF protection
All state-changing requests require valid CSRF tokens.