New: identify your users — now free on every planGet started →

Security

Built to keep feedback safe.

Say So is a small, focused product. Here’s plainly how we protect your account, your visitors’ submissions, and your integrations.

Accounts & access

Authentication is handled by a dedicated auth library with session cookies — we don't roll our own crypto.
Every dashboard action is scoped to your account: ownership is enforced in the query, never assumed.
Billing runs through Stripe. Card details go straight to Stripe — Say So never sees or stores them.

The widget & public API

Each project has an allowed-origins list, so the widget only accepts submissions from domains you name.
Per-IP rate limiting protects your endpoints from spam and abuse.
The widget renders in a Shadow DOM, isolated from your site's scripts and styles.
Screenshot uploads are restricted to our own storage origin, so arbitrary URLs can't be injected.

Data & integrations

Data is stored in managed PostgreSQL and served over HTTPS.
Third-party integration tokens (e.g. Slack) are encrypted at rest with AES-256-GCM — never stored in plaintext.
Outbound webhooks are signed (HMAC-SHA256) so your endpoint can verify they came from Say So.
Inbound requests from Slack are verified by signature before we act on them.

Privacy

Your feedback is yours. We don't sell it, and we don't use it to train anything.
External services (email, screenshots, rate limiting) are optional and degrade gracefully when disabled.

Found a vulnerability? Email hello@trysay.so and we’ll respond quickly. Please give us a chance to fix it before disclosing publicly.