Security
Built so people stay in charge of the board.
Freero lets AI agents work on the same boards as people. That only works if agents can’t see more than they should, can’t be talked into things by board content, and can be switched off instantly. Here is how.
Agents and integrations
Every app, agent and script is a credential that acts for one person, checked on every request.
Least power by default
MCP connections get read and suggest. Writing and commenting are opt-in scopes, and a credential never exceeds its person’s role on the board.Untrusted content boundary
Board text reaches agents only inside an untrusted-content envelope that board text can’t close. Tool names, descriptions and errors are Freero’s own words, never board text.Server-side privacy
Private-mode drafts and hidden frames are withheld by the server, so they never reach an agent, a webhook or the search index for people who can’t see them.Bound, short-lived tokens
OAuth 2.1 with mandatory PKCE, one-hour access tokens, rotating refresh tokens (a replayed one ends the whole consent), tokens bound to the API or the MCP server they were issued for. Only hashes are stored.Kill switches
Pause or revoke a token, disconnect an app, disconnect everything at once, block an app for a team, turn API access off for a team, or for the whole instance. Effective on the next request.Audit and limits
Every API and MCP call is an audit event. Each credential has its own request and write budget, separate from people’s editing.
Accounts and sign-in
- Can: Passwords hashed with scrypt; sign-in rate-limited per address and per network
- Can: Two-step verification with an authenticator app and recovery codes
- Can: Sign in with Google or Microsoft, and SAML or OpenID Connect SSO per workspace
- Can: Enforced SSO also applies to tokens and apps made without it
- Can: An email when your password, address, two-step setup or sign-in methods change, or a new browser signs in
- Can: See your sessions with their approximate location and sign out any of them
- Can: Signing out everywhere also revokes tokens and app connections
- Can: SCIM 2.0 deprovisioning ends a person’s access, sessions and tokens
Boards and sharing
Roles enforced by the server
Owner, editor, commenter and viewer. A viewer’s connection can’t write, whatever its client sends.Share links you control
Invite by email or share a link with a chosen role, an optional password and an expiry date; guests can be allowed or not.Workspace policies
Who may share, invite guests, export or download; session length and idle timeouts; live embeds on or off.Uploads that can’t run
Files are recognised by their bytes; anything that isn’t a known image, PDF or media file downloads as an attachment and never runs in Freero’s origin.Outbound requests checked
Link previews, webhooks, tracker and AI endpoints use https and refuse private, loopback and link-local addresses, also after DNS, unless the operator allows a private network.Secrets sealed at rest
Two-step secrets, tracker credentials, AI keys and webhook secrets are encrypted with AES-256-GCM under a rotatable key.
Platform
- Can: A strict Content-Security-Policy, HSTS over HTTPS, and frame-ancestors none
- Can: Cross-site request checks on every state-changing request and WebSocket upgrade
- Can: Rate limits on sign-in, sign-up, uploads, invitations, AI, the API and more, shared across instances through Redis
- Can: An append-only audit log, hash-chained per workspace, with export and an integrity check
- Can: Personal and workspace data exports, and account deletion with a grace period (GDPR)
- Can: Abuse reporting and a moderation queue for whoever operates the server
Freero has no AI model of its own: built-in AI actions are off until a provider is configured, and Freero doesn’t store prompts or answers. See AI in Freero.
Everything here is in the open: the source code, the architecture and every setting. Report a vulnerability to the contact in the server’s /.well-known/security.txt.
Frequently asked questions
Is Freero SOC 2 or ISO 27001 certified?
No. Freero is a free, open-source project and does not hold third-party certifications. Its security architecture is documented and its code is public; organisations that need their data to stay in their own environment can host Freero themselves.
Where is my data stored?
In the PostgreSQL database and the file storage of the Freero server you use. When you host Freero yourself, that is wherever you run it: your database, your S3-compatible storage, your network and region.
Can an AI agent read boards I didn’t share with it?
An agent acts for one person and can only reach boards that person can open, as that person sees them, within the permissions granted to the connection. A workspace can turn API and app access off, block a specific app, or restrict downloads so that apps can’t read its boards’ content.
Bring your team and your agents to one board
Free to use, open source, and yours to host. No credit card, no seat count.