This page is the short, practical version. The full Privacy policy also says who else sees what, how long it is kept, and your rights.
What the server stores encrypted#
The parts of a profile that are the account itself are encrypted on the computer that saves them, before they leave it, with your team's key. The server stores them and hands them back. It never receives the team key, so what it stores, it cannot open.
- The browser data of every profile: cookies and sessions, history, site data, passwords and autofill saved in the browser, bookmarks, extensions and their data.
- The profile's saved Logins: usernames, passwords and two factor seeds.
- Proxy logins and passwords, and WireGuard configs.
The team key itself is sealed separately for each person, so it opens only on their computer, with their password. When the owner lets someone in, their computer seals the key for that person; the server passes it on without being able to read it.
Each computer remembers which team key it was given. If the server ever hands a computer a different key without the key having been replaced in the team, SablePower refuses it and says so. Tell the team owner at once if you see that.
Your password#
Your password unlocks the team key on your computer. To sign you in, the app sends it to the server over an encrypted connection (TLS); the server checks it and keeps only a hash of it, never the password and never the key it opens. So nobody can reset it for you. Keep it in a password manager.
Honestly: this protects the stored data from anyone who reads the server's disk or its backups. It cannot protect it from someone who takes over the server and changes its program, because that program sees your password each time you sign in. That is true of every service you sign in to with a password.
What the server can read#
To run the team it needs to see some things in the clear:
- Accounts: each person's email, role and rights.
- Team, project and profile names; a profile's tags, notes, stage, numbers, platforms and their app window addresses, start pages (and a phone link set in an older version); its device and fingerprint settings.
- Proxies: label, type, host and port, the check results, notes and your own columns. Not the login and password.
- The Activity log: who opened, changed, shared or deleted what, when, and from which computer; sign ins and live sessions.
- The plan, and how many profiles and members are used.
So keep secrets out of names, tags and notes. Passwords go in the password fields and in Logins, which are encrypted.
Backups#
The team server is copied every night: the database and every profile's saved data, in two separate places. Profile data stays as encrypted in the copies as on the server. A profile you delete goes to the Trash first and can be restored from there; Delete for good removes it.
What the VA limits stop#
A VA without the rights Export cookies and See passwords (the recommended set) gets, in every profile of that project:
- no browser developer tools;
- no exporting of passwords and bookmarks;
- no automation of the profile;
- nothing of the profile left on their computer after it closes;
- the proxy working without its password being shown.
The profile says which of these apply when it opens. The owner's Sites lists can keep a VA's profile on the platforms it is for.
Honestly: these limits turn off the buttons and the usual ways to take an account out. They do not stop a determined technical person who has the profile open: while it is open, its data and the proxy's password are on their computer, and their own computer can be made to give them up. Give live accounts to people you would trust with the accounts themselves, and remove people who leave at once (how).
Sign in security#
The owner and admins: Users, Security tab.
- Second factor: ask everyone for a code from an authenticator app on a new device, or at every sign in. People without one are led to set it up.
- Sign in only from: addresses or ranges, one per line. Sign ins from anywhere else are refused before the password is checked.
- Ask for a code again before actions that cannot be undone: deleting a profile for good, removing a member, changing the policy.
- Who is signed in: every live session; End signs that computer out within seconds.
- Sign in journal: every sign in, with wrong passwords and refused addresses.
Everyone can switch on their own second factor: Settings, Team server, Second factor.
On your computer#
- Stay unlocked between launches (Settings, Team server) keeps you unlocked when SablePower restarts. On a computer other people use, untick it: SablePower then asks for your password at every start.
- Sign out ends the session on this computer; the next screen asks for the password.
- Anyone who can use your computer account can use what is open in it. Lock the screen when you step away.
Free software#
SablePower is free and open source software under the GNU AGPL, version 3 or later. The source of the version you run, our changes included, is yours on request.