Security
Your boards hold real work. We treat them that way.
Every account has two-factor sign-in, every file is private to its board, and every session is encrypted. Here's how it fits together.
Two-factor sign-in
A second step for everyone, from day one.
Two-factor authentication isn't optional on Wattle Board, and it isn't hard either. You choose how your second step works.
Code by emailDefault
After your password, we email you a 6-digit code. Nothing to install or set up, so every account is covered from the first sign-in.
Authenticator appOptional
Prefer an app? Scan a QR code with any TOTP authenticator. You'll get one-time recovery codes to keep somewhere safe, in case you lose your phone.
PasskeyOptional
Sign in with your fingerprint, face or device PIN. A passkey checks it's really you on its own, so there's no password or code to type, and nothing a fake site could steal.
Trust this device
Tick it on your own computer and we won't ask for a code there for 30 days.
Sign out everywhere
Lost a laptop? End every session on every device in one click.
Accounts
How we look after your account
Verified email
Every account confirms its email address before it can be used.
scrypt password hashing
We never store your password, only a slow, salted scrypt hash of it.
Encrypted authenticator secrets
The secret behind your authenticator app is encrypted at rest with AES-256-GCM.
Rate-limited sign-in
Repeated failed attempts are slowed down, so passwords and codes can't be guessed at speed.
Encrypted session cookies
Your session lives in an encrypted, httpOnly cookie that scripts on the page can't read.
One-time recovery codes
Each recovery code works once, so a used code can't be replayed.
Boards and files
How we look after your boards
Roles on every board
Viewer, Editor and Admin decide who can read, change and share each board.
Access by request
A board link alone doesn't let anyone in. They have to ask, and an admin has to approve.
Private attachments
Files are never public. They're only served to people with access to their board.
Board lock
Make a board read-only when it shouldn't change.
Activity log
See who changed what on a board, and when.
Strict security headers
Pages can't be framed by other sites, and browsers are told not to guess content types.
30 days to undo a delete
Deleted boards and workspaces wait 30 days in Recently deleted, and a closed account can be reopened by signing in. Then they're deleted for good.
Files checked on upload
Every file is checked against the type it claims to be, and photos lose hidden camera and location data before they're stored.
Your data, any time
Download everything we hold about you as a file from your account settings, any time.
Where it runs
Wattle Board runs on infrastructure chosen by Wattle Cloud, the Australian company that builds it. We don't use analytics or advertising trackers, and we don't sell your data. Read the Privacy Policy.
Responsible disclosure
Found a security problem?
We'd like to hear about it. Email us with the details and steps to reproduce it. We'll reply, keep you updated while we fix it, and credit you if you'd like.
[email protected]When you test, please
- 1Only test accounts and boards you own or have permission to test.
- 2Don't access or change other people's data.
- 3Don't run denial-of-service tests or send spam.
- 4Give us a reasonable chance to fix the problem before you share it.
If you follow these rules in good faith, we won't take action against you. The Acceptable Use Policy has the details.
Secure from the first sign-in.
Every Wattle Board account gets the same protection, on every plan.