Security
A short overview of how Almox keeps your data safe.
Authentication
Sign-in is by email and password, or by single-use magic link for clients who prefer not to manage a password. Almox never stores plaintext passwords or sees them after you set them.
Encryption
All traffic between your browser and Almox is encrypted in transit. The same applies to your portal, whether you use the default almox.ai address or a custom domain, encryption is automatic and managed for you.
Stored data, file uploads, and backups are all encrypted at rest.
Tenant isolation
Each workspace's data is fully isolated. There's no way for one workspace to see another workspace's data, regardless of role.
Client access
A client only sees content explicitly shared with them. There's no "see all my agency's stuff if I find the right URL", every shareable resource is gated by membership or by a secure, resource-specific link.
What you can do on your side
- Use a strong, unique password and a password manager
- Enable 2FA on your account if available
- Be careful who you make an admin (admins have full workspace access)
- Audit your Clients and Team lists periodically and remove inactive members
Reporting a security issue
If you think you've found a security issue, please contact us privately rather than posting publicly. See Contact us.
