Security

Every tenant's data is isolated using PostgreSQL row-level security, enforced at the database level — not just filtered in application code. A request for one account's data is structurally incapable of returning another account's rows, regardless of application-layer bugs.

All payment processing runs through Stripe. Card details are entered directly into Stripe's hosted Checkout page and never pass through FreelancerOS's servers. We store a reference to your subscription, never your card number.

Files are stored in Cloudflare R2, isolated per tenant by storage key prefix. Every download uses a signed URL with a short expiry — nothing is ever publicly accessible by default. Uploads are validated by inspecting file content (not just the extension) to block disguised executables.

Authentication is handled by Clerk, including password storage, session management, and multi-provider sign-in (email, Google, GitHub, Vercel). FreelancerOS never sees or stores your password.

The application runs on Railway with a managed PostgreSQL database and Redis cache. Traffic is served over HTTPS with HSTS enabled.

Project descriptions and briefs may be sent to OpenAI and Anthropic to generate workflows. You give explicit consent to this during onboarding and can withdraw it at any time from Settings.

If you've found a security vulnerability, please email hello@freelanceros.online directly rather than filing a public issue. We'll acknowledge reports as quickly as we can — this is a small, solo-founder team, so response times won't match a large company's security team, but every report is read personally.