Security
Last updated July 24, 2026
Overview
Handit holds the requests a team hands off to each other, so keeping that data private and separated is core to how it is built. This page describes the safeguards in plain terms. It is a summary of current practices, not a certification or guarantee.
Workspace isolation
Every organization is a separate tenant. Each ask, member, note, and attachment belongs to one organization, and server-side authorization scopes reads and writes to that organization. Asks can move only between people in the same organization.
Access within a workspace
An ask is readable only by the person who sent it, the person who owns it, and workspace admins—not the whole company by default. The server enforces who may change status, add notes, reroute, or withdraw an ask, regardless of what a browser client requests.
Authentication
Clerk handles sign-in using configured identity methods. Handit does not receive or store user passwords. Access requires a verified identity, and joining an existing workspace requires an invitation. Workspace admins manage membership and roles.
Encryption and managed infrastructure
Traffic to and from Handit is encrypted in transit with TLS. Application data and files are stored with managed infrastructure providers that encrypt storage at rest. Production secrets are kept in provider-managed environment configuration rather than shipped to the browser.
Limited production access
Handit does not routinely inspect workspace content. Production access is limited to authorized operators and the minimum needed for support you request, a failed automated process, security or abuse investigation, or a legal obligation. Access to downloaded backups is limited to operators who can access production data.
Providers, monitoring, and backups
Handit uses a small set of managed providers listed on the subprocessors page. Optional Sentry monitoring is configured not to send default personal information. Resend delivery events help identify bounces, complaints, and failed notifications. Managed and encrypted backups support disaster recovery and are not used as an ordinary content archive.
Product boundaries
Handit is an early-stage product and does not yet claim formal security or compliance certifications or a service-level agreement. Customers should not use it as the sole authoritative record for emergency or safety-critical instructions. We do not sell data, use workspace content for advertising, or train models on customer content.
Deletion and incident reporting
Authorized admins can request workspace closure and deletion as described in the Privacy Policy. If you find a vulnerability, suspect unauthorized access, or need security information for a vendor review, email hello@handit.to. Please do not include sensitive workspace content in the first report.