Security doesn't need to be complicated. Here's how we think about protecting your team's data at NoHeck — explained simply.
Principle 1: Least Privilege
Not everyone needs access to everything. That sounds obvious, but most team tools give everyone admin access by default and call it "collaboration."
At NoHeck, we use role-based access control (RBAC) with three clear levels: - Owners — Full administrative control. Can manage billing, invite members, and configure workspace settings. - Managers — Can manage specific features like boards and channels, but can't modify workspace-level settings. - Members — Can participate in channels, use messaging, and access assigned work.
This isn't an enterprise upsell. Every NoHeck workspace — even free ones — gets real access control.
Principle 2: Data Isolation
Your workspace data is completely separated from every other organization's data. This is called tenant isolation, and it means: - Your messages can't leak into another workspace - Your files are stored in isolated containers - Your admin settings only affect your workspace
Principle 3: Encryption Everywhere
- In transit: All connections use TLS 1.2 or higher
- At rest: Data is encrypted using AES-256
- Passwords: Hashed with bcrypt, never stored in plaintext
Principle 4: Transparency
We don't hide behind vague "enterprise-grade security" marketing. Here's what we actually do: - Public changelog so you know what's changed - Published privacy policy that's actually readable - Real terms of service, not a 40-page legal novel
What's Coming
We're working toward SOC 2 Type II certification and building out enterprise governance features including SSO, SCIM provisioning, and advanced audit logging.
Questions about security? Visit our Trust Center.