Verified identity
Sign-in is handled by Clerk. Private routes require a verified identity and tenant context; client-provided account IDs never establish tenancy.
Security
How Pickentra handles access and data
Controls described here are those implemented in the current code and documentation. This is an implementation summary, not a certification.
Controls
What is in place
Separate admin privileges
Owner/admin permissions are distinct from platform-admin privileges. New users are pending, never automatic administrators.
Request protection
Mutations require a trusted Origin and a signed double-submit CSRF token. JSON bodies are strict and limited to 32 KB. Requests are rate limited per IP.
Content Security Policy
Helmet CSP with exact allowed origins. Inline scripts and objects are not allowed.
Safe errors and logs
Errors return a safe code, message and request ID, not stack traces. Logs omit request bodies and headers and redact named provider secrets.
Bounded crawling
HTTPS-only, same-site, public addresses only, robots.txt respected, strict limits on pages, bytes, time and redirects.
Your data
Retention, export and deletion
Reports and evidence are preserved during the early stages so history stays comparable.
Export and deletion are manual, owner-assisted operations verified through the signed-in account and an approved support channel. There is no automatic deletion timer.
We do not claim compliance certifications or uptime guarantees.
Questions: info@pickentra.com. See also the Privacy Policy.