Security
Last updated on August 10, 2026.
Permission controls
Private board access is checked on the server against workspace membership and the assigned role.
Share tokens, passwords, and access grants are treated as credentials and are excluded from user-facing records and analytics.
Authentication and sessions
Sign-in uses an external identity provider rather than a separate Moodboard password. Session admission and revocation are enforced on the server, and private product routes are kept out of search indexing.
Authentication state does not by itself grant board access; workspace and board authorization are evaluated for the requested resource and action.
Storage boundaries
Metadata, collaborative board documents, binary assets, export artifacts, sessions, and billing records have distinct storage and authorization boundaries.
Encrypted HTTPS connections protect data in transit. Infrastructure providers supply controls for data at rest according to the service boundary they operate.
Application boundaries
The visual document has one durable owner, while registry, authorization, commercial facts, immutable files, and transient collaboration each remain in their appropriate service boundary. This reduces duplicated state and ambiguous write paths.
Public marketing analytics is limited to an allowlist of public routes. Private board paths and secret-bearing links are excluded rather than merely redacted.
Operational proof
Access denial, read-only sharing, export downloads, and session revocation are verified independently so one successful check cannot stand in for another.
A green source gate, an online Preview, a successful browser check, and Production availability remain separate claims. Moodboard does not present an unfinished acceptance gate as proof that every product workflow is complete.
Report a security issue
If you believe you found a vulnerability or unauthorized access path, email support@moodboard.art with the affected URL, reproduction steps, and potential impact. Do not include live credentials or private board content in the first message.