Built with security
in every layer.

Strong authentication and access control.

Unboredly uses secure, identity-based authentication and role-based authorization throughout the platform. Optional authenticator-app two-factor authentication adds a layer of account protection beyond passwords.

Access decisions are enforced at the data layer, not simply by hiding features in the interface. Administrator, manager and employee capabilities are separated according to their responsibilities.

• Authenticator-app two-factor
• Role-based access control
• Data-layer authorization
• Email verification
• Automatic sign-out after inactivity

Organization-level data isolation.

Unboredly is a multi-tenant platform with authorization controls that keep each organization’s data separate. Access is evaluated using authenticated identity, organization membership and role before any protected data operation is allowed.

We maintain automated authorization tests designed specifically to catch cross-organization access and privilege-boundary regressions.

• Organization-scoped access
• Cross-organization regression tests
• Privilege-boundary tests

Protected by modern cloud infrastructure.

Unboredly uses Google cloud services for identity, application data and storage, and benefits from Google’s mature security infrastructure and built-in encryption.

Google encrypts customer content at rest by default, using AES-256 at the storage layer, and protects data in transit. Every Unboredly page and request is served over HTTPS (TLS).

• Encrypted at rest (AES-256)
• HTTPS / TLS in transit
• Google cloud security infrastructure

Secure application delivery.

Unboredly’s application is delivered on Vercel’s platform, which provides secure HTTPS delivery and modern cloud deployment infrastructure.

Vercel encrypts data at rest with AES-256 and uses TLS for data in transit.

• HTTPS delivery
• Encrypted at rest and in transit
• Modern cloud deployment

Continuous vulnerability testing.

Automated dynamic application security testing is part of how we build. Unboredly’s public application is scanned with OWASP ZAP every week and whenever the codebase changes, to find common web security weaknesses and configuration issues.

This scanning complements the automated application and authorization tests we run during development.

• OWASP ZAP security scanning
• Weekly and on every code change
• Web configuration checks

Security tested with every change.

Security checks are built into Unboredly’s development lifecycle. Every change runs automated build, application, authorization and end-to-end tests.

Security-sensitive features have dedicated regression tests, so weaknesses we have fixed and authorization rules we rely on stay that way.

• Security regression tests
• Authorization boundary tests
• End-to-end application tests
• Automated CI/CD checks