Security at Recordbook

Data encryption

All data transmitted between your browser and Recordbook is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. Your workspace data is never stored in plaintext.

Access controls

Recordbook provides role-based access controls that let you define exactly what each teammate can see, edit, or manage. Workspace owners can assign roles with granular permissions at the table and record level, minimising exposure of sensitive data.

Authentication

We support secure email-based authentication with session management. Sessions are invalidated on sign-out and expire automatically after a period of inactivity. We recommend using a strong, unique password for your account.

Infrastructure security

Recordbook is hosted on cloud infrastructure with industry-standard security practices. We use isolated environments for production, employ regular vulnerability assessments, and maintain separation of data between workspaces.

Data backups

Your workspace data is backed up regularly to ensure recovery in the event of an incident. Backup data is also encrypted and stored in geographically separate locations.

Incident response and breach notification

We maintain an incident response process. In line with Indian law, we report notifiable cyber security incidents to CERT-In within the prescribed time, and we notify the Data Protection Board of India and affected users of personal data breaches as required by the Digital Personal Data Protection Act, 2023.

Responsible disclosure

If you discover a security vulnerability in Recordbook, please report it responsibly by emailing our security team. We will acknowledge your report within 48 hours and aim to resolve confirmed issues promptly. Please do not publicly disclose the issue before we have had a chance to address it, and do not access or modify other users' data while testing.

Compliance

Recordbook is operated by Mensa Labs Private Limited, incorporated in India. We process personal data in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the SPDI Rules, 2011, and, where applicable, the GDPR for users in the European Economic Area. We do not sell your personal data to third parties.

Contact security team

To report a security vulnerability or ask a question about how we handle your data, please reach out directly:

Also see our Privacy Policy and Terms of Service.