Security at Morvero

Last updated: 20 July 2026

Morvero collects product usage and feedback for enterprise application portfolios. This page describes, concretely, how that data is protected. It lists what we do today — not aspirations. Where a control is on our roadmap rather than in place, it says so explicitly.

Anonymous by design

• The analytics widget sets no cookies. Visitors are identified by a random, meaningless id (v_…) generated in the browser and kept in that browser's local storage — it contains no personal data, is never joined to a directory or identity provider, and cannot follow a person across devices.
• We collect page paths, titles, ratings, comments and (optionally, user-initiated) page screenshots. The widget asks users not to include personal details in comments, and feedback submission is explicitly anonymous in the UI.
• There is no identity resolution, no fingerprinting, and no cross-site tracking of any kind. Employee-facing deployments do not require consent banners for the widget itself because it stores nothing on the device beyond the random id.
• Optional cohort labels (e.g. department) are aggregate-only and enforced behind a k-anonymity floor: any cohort with fewer than 5 distinct visitors in the selected range is withheld entirely — no counts, no ratings — so small groups can never be singled out.

Encryption

• In transit: all traffic is served over TLS; HSTS (max-age one year, includeSubDomains) is sent on every response in production.
• At rest: data lives in a managed PostgreSQL instance (see subprocessors). Integration credentials your workspace stores with us — Jira and Azure DevOps tokens, webhook signing secrets — are additionally sealed application-side with AES-256-GCM before they touch the database, under a key held only in the runtime environment.
• Tokens: MCP/OAuth bearer and refresh tokens are stored as SHA-256 hashes only; authorization codes are single-use with a 5-minute TTL and PKCE (S256) is mandatory — no public client ever authenticates with a secret.

Authentication & access control

• Morvero is passwordless: sign-in is by passkey (WebAuthn) or single-use, 15-minute emailed magic links. There are no passwords to phish, stuff, or leak.
• Enterprise plans support SAML single sign-on with just-in-time provisioning and a claimed-domain check.
• Role-based access: owner / admin / member / viewer, plus a separate privacy-operator grant for GDPR tooling and per-product Product Owner assignment. Members see only the products assigned to them; every server-side query is scoped by workspace and role.
• Sessions are HttpOnly, SameSite cookies (Secure in production). AI coding agents connect through OAuth 2.1 with granular, user-revocable grants — each user sees and can revoke their connected apps in Settings.
• Platform staff access to customer workspaces is break-glass only: it requires a stated reason, is visible to the tenant, and every action lands in the tenant's own audit log.

Tenant isolation & auditability

• Morvero is multi-tenant with workspace-scoped authorization on every route; product data is only reachable through the owning workspace's roles.
• A per-workspace audit log records logins, role changes, integration changes, OAuth grants and revocations, impersonation, exports and deletions — exportable by owners.

Data lifecycle

• Retention windows are enforced, not advisory: each workspace sets a retention period and a scheduled job hard-deletes usage events, actions and feedback older than it.
• Owners can export their workspace's data, and privacy operators can look up and erase everything held for a given visitor id (GDPR/KVKK tooling).
• Deleting a workspace deletes its products, feedback, events, admins and grants.

Application security

• Strict security headers on every response: Content-Security-Policy, X-Frame-Options / frame-ancestors (framing denied except two deliberate, documented cases), nosniff, Referrer-Policy.
• Outbound integration calls (webhooks, Jira, Azure DevOps) pass an SSRF egress guard that refuses private-network destinations.
• Rate limiting on authentication, collection and API surfaces; anti-enumeration behavior on sign-in; CSV exports are formula-injection-safe; feedback screenshots exclude the widget itself.
• Webhooks are signed (HMAC) so receivers can verify origin.

Subprocessors

Reporting a vulnerability

We want to hear about it. Email security@morvero.com with reproduction steps; machine-readable details are published at /.well-known/security.txt. We commit to acknowledging reports within 3 business days. Please avoid accessing other tenants' data while researching — use a free workspace of your own.