Security

Permission controls

Private board access is checked on the server against workspace membership and the assigned role.

Share tokens, passwords, and access grants are treated as credentials and are excluded from user-facing records and analytics.

Authentication and sessions

Sign-in uses an external identity provider rather than a separate Moodboard password. Session admission and revocation are enforced on the server, and private product routes are kept out of search indexing.

Authentication state does not by itself grant board access; workspace and board authorization are evaluated for the requested resource and action.

Storage boundaries

Metadata, collaborative board documents, binary assets, export artifacts, sessions, and billing records have distinct storage and authorization boundaries.

Encrypted HTTPS connections protect data in transit. Infrastructure providers supply controls for data at rest according to the service boundary they operate.

Application boundaries

The visual document has one durable owner, while registry, authorization, commercial facts, immutable files, and transient collaboration each remain in their appropriate service boundary. This reduces duplicated state and ambiguous write paths.

Public marketing analytics is limited to an allowlist of public routes. Private board paths and secret-bearing links are excluded rather than merely redacted.

Security information

Access denial, read-only sharing, export downloads, and session revocation are verified independently so one successful check cannot stand in for another.

This page describes current technical controls. It does not claim an independent security certification, a compliance audit or an uptime guarantee.

Report a security issue

If you believe you found a vulnerability or unauthorized access path, email support@moodboard.art with the affected URL, reproduction steps, and potential impact. Do not include live credentials or private board content in the first message.