Workspace and client access
Server-side checks enforce workspace membership on application actions. Client portal access is restricted by the client contact linked to an invitation. A page being hidden is not treated as permission enforcement.
Authentication and credentials
Handra uses Better Auth with database-backed sessions. Provider secret fields are encrypted before storage and are not returned in the settings page. API tokens are stored as hashes, with a temporary encrypted reveal for the person creating a token.
Payments and automation
Provider webhook signatures are verified before processing. Payment amounts, currency and references are reconciled against invoices. Posting uses atomic database batches and duplicate protection. Outgoing automation events are signed and have delivery histories.
Your part
Use a strong, unique password. Share portal links only with the intended client. Treat webhook URLs and API tokens as credentials, and revoke them when access is no longer required. Review provider account permissions before connecting them.
Report a concern
Use our contact form to report a security issue. Do not include passwords, API keys, payment-card details or sensitive client records. Handra does not claim independent certification or a security guarantee.