Security
How we keep your workspace private.
Last updated: 2026-07-21
End-to-end encryption
Every product name, description, image, video, and message is encrypted on your device before it reaches our servers. We use X25519 for per-member key exchange and AES-256-GCM for authenticated content encryption. Servers only ever see opaque ciphertext.
Per-member keys
Each catalog has a content-encryption key (CEK) that is wrapped separately for every approved member using their public key. When you revoke a member, their wrapped key is removed and any new content is encrypted only for the remaining members.
Access control
Roles are enforced by row-level security at the database layer. Owners manage members, staff can help manage products, and members can view the catalog and message the owner. Invitations can require manual approval before granting access.
Transport and storage
All requests use TLS. Encrypted media is stored in a private object store; short-lived signed URLs are issued only to authenticated participants.
Responsible disclosure
If you believe you've found a security issue, please email security@onlymenu.io. We appreciate coordinated disclosure and will respond as quickly as we can.