Security

Last updated: July 13, 2026

Retrospectives contain some of the most sensitive things a team says out loud. Here is concretely how we protect that data — and an honest note about where we are as a company.

Sign-in without passwords

FocusRetro has no password database to breach. You sign in with Google (OAuth 2.0) or, on eligible plans, through your company’s SAML SSO — authentication stays with your identity provider, along with any MFA policies your organization enforces.

Encryption

  • In transit: all traffic between your browser and FocusRetro is encrypted with TLS, fronted by Cloudflare.
  • Integration credentials: tokens for Jira and Slack integrations are encrypted at rest with AES-256-GCM and are revoked the moment you disconnect an integration.

Access control on your boards

You decide who sees what: workspaces have role-based permissions, and boards can be private, restricted to workspace members, or protected with a board password. Guest invite links grant access only to the board they point to and can be revoked by the facilitator.

Anonymity by design

Several features are built so that sensitive input cannot be traced back to a person: feedback can be anonymized, voting can be blind until reveal, and team health-check answers are stored only as anonymous aggregates — individual answers are never linked to a user identity anywhere in our database.

Payments

Payments are handled end-to-end by Stripe, a PCI DSS Level 1 certified provider. Card details are entered on Stripe’s infrastructure and never touch our servers.

Infrastructure

The service runs in an isolated production environment with least-privilege access, behind Cloudflare’s network for TLS termination and protection against DDoS and common web attacks. Production access is limited to the people who operate the service.

Reporting a vulnerability

If you believe you have found a security issue, email [email protected] with enough detail for us to reproduce it. We will acknowledge your report quickly, keep you informed as we fix it, and will not pursue legal action against good-faith security research.

An honest note on certifications

We are a small, focused team. We do not yet hold SOC 2 or ISO 27001 certifications, and we would rather tell you that plainly than imply otherwise with badges. If your security team has a questionnaire, send it to [email protected] — we answer them directly and honestly.