Security, without the theatre.

How we approach it

The same idea that shapes our products shapes how we protect them: agents can do a lot of work, but people decide what happens to your data.

• Private by default. Projects, mailboxes and files start private. Nothing is shared or published unless you choose to.
• Least access. Each account's data is kept apart from every other's, and every request is checked against who is asking.
• Encrypted in transit and at rest. Our sites are served over HTTPS only, and sensitive values such as keys are encrypted where they're stored.
• We say what's true today. Each product's security page describes what's running now, not what's planned.

Gaitro

Gaitro holds code and the keys that go with it. In short:

• Secrets you give a project are encrypted at rest with AES-256-GCM and only decrypted to hand to a running check. Nobody, person or agent, can read one back, and values are replaced with their names in logs.
• Every check run gets a fresh, throwaway sandbox, running as an ordinary user.
• Built-in safety checks look at every change for leaked keys, unknown or misspelled packages, personal data in logs, unprotected endpoints and destructive database changes.
• Coding agents run on your own machine and your own AI account, so your prompts don't pass through us.

Full details: gaitro.com/security

Parcetta

Parcetta holds email, files and documents. In short:

• Each account's mail is isolated from every other account's.
• Two-factor sign-in is available to everyone, and a business can require it for its whole team.
• Look-alike and misleading links are flagged, and Parcetta asks before you open one.
• PDF tools run sandboxed in your browser, and an edited file stays on your device until you save it.
• Mail is checked with SPF, DKIM and DMARC.

Full details: parcetta.com/security

This website

farnorlabs.com is a static site served by Cloudflare. It has no accounts, no forms and no database, and it loads nothing from other companies. It's served over HTTPS only, with a strict content security policy that limits scripts, styles and fonts to this site.

Report a vulnerability

If you think you've found a security problem in any Farnor Labs product, please tell us privately first, using the addresses at the top of this page. Include:

• what you found, and which product and address it affects;
• the steps to see it for ourselves;
• what you think someone could do with it.

We'll reply to confirm we have it, keep you posted while we fix it, and tell you when it's done. If you'd like, we'll thank you by name once the fix is out.

Good-faith research

We won't take legal action against anyone who researches and reports in good faith and follows these rules:

• Only use accounts you own, or have permission to test.
• Don't read, keep, change or delete other people's data beyond the minimum needed to show the problem.
• Don't run denial-of-service tests, spam, or social engineering against our team or our customers.
• Give us reasonable time to fix the problem before you share it.