Security
Your workspace, your address, your data.
coMinute is built for teams that share client work. These are the rules the product follows to keep that work where it belongs.
One workspace per team
Isolated by design
Every record belongs to one workspace and every query is scoped to it. People, projects and companies never cross between workspaces.
Its own address
Each workspace is served on its own subdomain, and a session is only valid on the host that issued it.
Roles and private tasks
Roles are set per workspace, per team and per project. A private task is visible only to the people named on it.
Signing in
Google or email
Sign in with Google, or with an email address and a password. Passwords are stored only as bcrypt hashes.
Short sessions
Sessions live in httpOnly cookies. The access token lasts 15 minutes and is renewed in the background while you work.
Sign out everywhere
Changing or resetting a password ends every other session on the account, and you get a mail confirming the change.
New device alerts
A sign in from a device the account has never used sends its owner a notice. A familiar device stays quiet.
Verified addresses
Notification mail goes only to an address its owner has confirmed.
What you write and upload
Sanitised rich text
Descriptions, notes and comments are cleaned against a strict allowlist when they are saved and again when they are shown.
Checked images
An uploaded image is accepted only when its bytes are a known raster format, whatever the file claims to be.
No public links
Attachments and images are served only to signed in members of the workspace. There is no public or token-in-URL link to a file.
Scoped API keys
Workspace API keys carry only the scopes they were given and act as the person who created them.
What we do not claim
coMinute does not offer single sign-on, audit exports or a compliance certification today. When that changes, this page will say so.
Found something?
If you think you have found a security issue, write to support@cominute.com