Security

The website runs on a global edge network. The database and file storage are hosted in the EU (Paris, eu-west-3).

Data is encrypted in transit with TLS 1.2 or above, and encrypted at rest with AES-256.

Every table uses row-level security, so a signed-in account can only read or write its own rows. Uploaded images and audio live in a private bucket keyed to your account and are only reachable through short-lived links generated for you.

Sign-in is handled by our managed authentication provider, using either Google sign-in or an email and password stored only as a salted hash. Sessions use rotating tokens.

Payments are taken on our purchase page by our payment provider. Card details never reach Too Many Tabs. Purchase confirmations arrive as signature-verified webhooks, and only our own product is accepted.

You can export everything your account holds, restore a deleted tab for 30 days, remove a tab and its files for good, and delete your account and sign-in entirely — all from Settings.

If you think you've found a security issue, please email kate@toomanytabs.app with enough detail to reproduce it, and please don't access anyone else's data.