Security is part of the support workflow
Drexora Support uses layered controls to protect access to the dashboard and keep website support data separated by workspace.
Authentication
Account access uses Firebase Authentication. Protected API routes verify authentication tokens before allowing account operations.
Workspace isolation
Website records use immutable website-scoped widget IDs and resolve support data through the associated workspace context.
API protection
The backend uses HTTPS deployment, CORS controls, security headers, request validation, and rate limiting around API routes.
Responsible reporting
If you find a security issue, avoid sharing sensitive data publicly. Use the product's support path with clear reproduction details.
Security is ongoing
No online service can promise zero risk. We review the product as it changes and prioritize fixes that protect authentication, workspace separation, visitor data, and the public widget.