diff --git a/.circleci/config.yml b/.circleci/config.yml
index 44ec98450..ed8076483 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -33,7 +33,7 @@ workflows:
           context: main-builds
           filters:
             branches:
-              only: cristi/ci-test
+              only: cristi/ci-k8s-tor
 
 jobs:
   test_server:
@@ -90,13 +90,21 @@ jobs:
           command: env SPECKLE_SERVER_PACKAGE=preview-service ./.circleci/build.sh
       - run:
           name: Deploy
-          command: ./.circleci/deploy.sh
+          command: |
+            ./.circleci/deploy.sh
+            if [[ "$CIRCLE_TAG" =~ ^v.* ]]; then
+              env K8S_CLUSTER=TOR1 K8S_NAMESPACE=${K8S_NAMESPACE_TOR1_1_RELEASE} ./.circleci/deploy_in_new_setup.sh
+            else
+              env K8S_CLUSTER=TOR1 K8S_NAMESPACE=${K8S_NAMESPACE_TOR1_1_LATEST} ./.circleci/deploy_in_new_setup.sh
+            fi
       - run:
           name: Test deployment
           command: |
             ./utils/test-deployment/install_prerequisites.sh
-            SPECKLE_SERVER=https://latest.speckle.dev
             if [[ "$CIRCLE_TAG" =~ ^v.* ]]; then
-              SPECKLE_SERVER=https://speckle.xyz
+              ./utils/test-deployment/run_tests.py https://speckle.xyz
+              ./utils/test-deployment/run_tests.py ${SPECKLE_URL_TOR1_1_RELEASE}
+            else
+              ./utils/test-deployment/run_tests.py https://latest.speckle.dev
+              ./utils/test-deployment/run_tests.py ${SPECKLE_URL_TOR1_1_LATEST}
             fi
-            ./utils/test-deployment/run_tests.py $SPECKLE_SERVER
diff --git a/.circleci/deploy_in_new_setup.sh b/.circleci/deploy_in_new_setup.sh
new file mode 100755
index 000000000..b0b4a20c0
--- /dev/null
+++ b/.circleci/deploy_in_new_setup.sh
@@ -0,0 +1,73 @@
+#!/bin/bash
+
+set -e
+
+K8S_CLUSTER_CERTIFICATE_VARIABLE=K8S_${K8S_CLUSTER}_CERTIFICATE
+K8S_CLUSTER_CERTIFICATE=${!K8S_CLUSTER_CERTIFICATE_VARIABLE}
+
+K8S_TOKEN_VARIABLE=K8S_${K8S_CLUSTER}_TOKEN
+K8S_TOKEN=${!K8S_TOKEN_VARIABLE}
+
+K8S_SERVER_VARIABLE=K8S_${K8S_CLUSTER}_SERVER
+K8S_SERVER=${!K8S_SERVER_VARIABLE}
+
+# K8S_NAMESPACE
+
+IMAGE_VERSION_TAG=$CIRCLE_SHA1
+
+if [[ "$CIRCLE_TAG" =~ ^v.* ]]; then
+    IMAGE_VERSION_TAG=$CIRCLE_TAG
+fi
+
+echo "$K8S_CLUSTER_CERTIFICATE" | base64 --decode > k8s_cert.crt
+
+# Update deployments
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  set image deployment/speckle-frontend main=$DOCKER_IMAGE_TAG-frontend:$IMAGE_VERSION_TAG
+
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  set image deployment/speckle-server main=$DOCKER_IMAGE_TAG-server:$IMAGE_VERSION_TAG
+
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  set image deployment/speckle-preview-service main=$DOCKER_IMAGE_TAG-preview-service:$IMAGE_VERSION_TAG
+
+
+# Wait for rollout to complete
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  rollout status -w deployment/speckle-frontend --timeout=3m
+
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  rollout status -w deployment/speckle-server --timeout=3m
+
+./kubectl \
+  --kubeconfig=/dev/null \
+  --server=$K8S_SERVER \
+  --certificate-authority=k8s_cert.crt \
+  --token=$K8S_TOKEN \
+  --namespace=$K8S_NAMESPACE \
+  rollout status -w deployment/speckle-preview-service --timeout=3m
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..eef98c031
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.2.+   | :white_check_mark: |
+| < 2.2   | :x:                |
+
+## Reporting a Vulnerability
+
+Hi! If you've found something off, we'd be more than happy if you would report it via security@speckle.systems. We will work together with you to correctly identify the cause and implement a fix. Thanks for helping make Speckle safer! 
diff --git a/packages/frontend/src/components/dialogs/ServerInviteDialog.vue b/packages/frontend/src/components/dialogs/ServerInviteDialog.vue
index d04b7ccbb..189fc4e08 100644
--- a/packages/frontend/src/components/dialogs/ServerInviteDialog.vue
+++ b/packages/frontend/src/components/dialogs/ServerInviteDialog.vue
@@ -20,7 +20,11 @@
               :rules="validation.emailRules"
               label="email"
             ></v-text-field>
-            <v-text-field v-model="message" label="message"></v-text-field>
+            <v-text-field
+              v-model="message"
+              :rules="validation.messageRules"
+              label="message"
+            ></v-text-field>
             <v-card-actions>
               <v-btn block color="primary" type="submit">Send invite</v-btn>
             </v-card-actions>
@@ -32,6 +36,7 @@
 </template>
 <script>
 import gql from 'graphql-tag'
+import DOMPurify from 'dompurify'
 
 export default {
   name: 'ServerInviteDialog',
@@ -48,6 +53,17 @@ export default {
         emailRules: [
           (v) => !!v || 'E-mail is required',
           (v) => /.+@.+\..+/.test(v) || 'E-mail must be valid'
+        ],
+        messageRules: [
+          (v) => {
+            if (v.length >= 1024) return 'Message too long!'
+            return true
+          },
+          (v) => {
+            let pure = DOMPurify.sanitize(v)
+            if (pure !== v) return 'No crazy hacks please.'
+            else return true
+          }
         ]
       }
     }
diff --git a/packages/frontend/src/components/dialogs/StreamInviteDialog.vue b/packages/frontend/src/components/dialogs/StreamInviteDialog.vue
index c5b7ba657..526367242 100644
--- a/packages/frontend/src/components/dialogs/StreamInviteDialog.vue
+++ b/packages/frontend/src/components/dialogs/StreamInviteDialog.vue
@@ -21,7 +21,11 @@
               :rules="validation.emailRules"
               label="email"
             ></v-text-field>
-            <v-text-field v-model="message" label="message"></v-text-field>
+            <v-text-field
+              v-model="message"
+              :rules="validation.messageRules"
+              label="message"
+            ></v-text-field>
             <v-card-actions>
               <v-btn block color="primary" type="submit">Send invite</v-btn>
             </v-card-actions>
@@ -33,6 +37,7 @@
 </template>
 <script>
 import gql from 'graphql-tag'
+import DOMPurify from 'dompurify'
 
 export default {
   name: 'StreamInviteDialog',
@@ -55,6 +60,17 @@ export default {
         emailRules: [
           (v) => !!v || 'E-mail is required',
           (v) => /.+@.+\..+/.test(v) || 'E-mail must be valid'
+        ],
+        messageRules: [
+          (v) => {
+            if (v.length >= 1024) return 'Message too long!'
+            return true
+          },
+          (v) => {
+            let pure = DOMPurify.sanitize(v)
+            if (pure !== v) return 'No crazy hacks please.'
+            else return true
+          }
         ]
       }
     }
diff --git a/packages/server/app.js b/packages/server/app.js
index 205a881ab..defcd632b 100644
--- a/packages/server/app.js
+++ b/packages/server/app.js
@@ -117,9 +117,12 @@ exports.init = async ( ) => {
  * @param  {[type]} app [description]
  * @return {[type]}     [description]
  */
-exports.startHttp = async ( app ) => {
+exports.startHttp = async ( app, customPortOverride ) => {
   let bindAddress = process.env.BIND_ADDRESS || '127.0.0.1'
   let port = process.env.PORT || 3000
+
+  if ( customPortOverride ) port = customPortOverride
+
   app.set( 'port', port )
 
   let frontendHost = process.env.FRONTEND_HOST || 'localhost'
diff --git a/packages/server/modules/core/scopes.js b/packages/server/modules/core/scopes.js
index 9525ee930..7d1f4f47d 100644
--- a/packages/server/modules/core/scopes.js
+++ b/packages/server/modules/core/scopes.js
@@ -31,6 +31,11 @@ module.exports = [
     description: 'Read other users\' profile on your behalf.',
     public: true
   },
+  {
+    name: 'server:stats',
+    description: 'Request server stats from the api. Only works in conjunction with a "server:admin" role.',
+    public: true
+  },
   {
     name: 'users:email',
     description: 'Access the emails of other users on your behalf.',
diff --git a/packages/server/modules/core/tests/objects.spec.js b/packages/server/modules/core/tests/objects.spec.js
index a83e3d556..aaf84967a 100644
--- a/packages/server/modules/core/tests/objects.spec.js
+++ b/packages/server/modules/core/tests/objects.spec.js
@@ -480,8 +480,8 @@ describe( 'Objects @core-objects', ( ) => {
 
 const crypto = require( 'crypto' )
 
-function createManyObjects( shitTon, noise ) {
-  shitTon = shitTon || 10000
+function createManyObjects( num, noise ) {
+  num = num || 10000
   noise = noise || Math.random( ) * 100
 
   let objs = [ ]
@@ -490,7 +490,7 @@ function createManyObjects( shitTon, noise ) {
   objs.push( base )
   let k = 0
 
-  for ( let i = 0; i < shitTon; i++ ) {
+  for ( let i = 0; i < num; i++ ) {
     let baby = {
       name: `mr. ${i}`,
       nest: { duck: i % 2 === 0, mallard: 'falsey', arr: [ i + 42, i, i ] },
@@ -504,7 +504,7 @@ function createManyObjects( shitTon, noise ) {
     }
 
     if ( i % 3 === 0 ) k++
-    getAFuckingId( baby )
+    getAnId( baby )
 
     base.__closure[ baby.id ] = 1
     if ( i > 1000 )
@@ -513,10 +513,10 @@ function createManyObjects( shitTon, noise ) {
     objs.push( baby )
   }
 
-  getAFuckingId( base )
+  getAnId( base )
   return objs
 }
 
-function getAFuckingId( obj ) {
+function getAnId( obj ) {
   obj.id = obj.id || crypto.createHash( 'md5' ).update( JSON.stringify( obj ) ).digest( 'hex' )
 }
diff --git a/packages/server/modules/serverinvites/services/index.js b/packages/server/modules/serverinvites/services/index.js
index ac97bbd4a..8bb16c089 100644
--- a/packages/server/modules/serverinvites/services/index.js
+++ b/packages/server/modules/serverinvites/services/index.js
@@ -2,6 +2,7 @@
 const appRoot = require( 'app-root-path' )
 const crs = require( 'crypto-random-string' )
 const knex = require( `${appRoot}/db/knex` )
+const sanitizeHtml = require( 'sanitize-html' )
 
 const { getUserByEmail, getUserById } = require( `${appRoot}/modules/core/services/users` )
 
@@ -19,6 +20,15 @@ module.exports = {
 
     if ( existingUser ) throw new Error( 'This email is already associated with an account on this server!' )
 
+    if ( message ) {
+      
+      if ( message.length >= 1024 ) {
+        throw new Error( 'Personal message too long.' )
+      }
+
+      message = module.exports.sanitizeMessage( message )
+    }
+
     // check if email is already invited
     let existingInvite = await module.exports.getInviteByEmail( { email } )
     if ( existingInvite ) throw new Error( 'Already invited!' )
@@ -126,5 +136,11 @@ This email was sent from ${serverInfo.name} at ${process.env.CANONICAL_URL}, dep
 
     await Invites().where( { id: id } ).update( { used: true } )
     return true
+  },
+
+  sanitizeMessage( message ) {
+    return sanitizeHtml( message, {
+      allowedTags: [ 'b', 'i', 'em', 'strong' ],
+    } )
   }
 }
diff --git a/packages/server/modules/serverinvites/tests/serverInvites.spec.js b/packages/server/modules/serverinvites/tests/serverInvites.spec.js
index 1bed94c85..6521e53a5 100644
--- a/packages/server/modules/serverinvites/tests/serverInvites.spec.js
+++ b/packages/server/modules/serverinvites/tests/serverInvites.spec.js
@@ -4,6 +4,7 @@ const chai = require( 'chai' )
 const request = require( 'supertest' )
 const assert = require( 'assert' )
 const appRoot = require( 'app-root-path' )
+const { async } = require( 'crypto-random-string' )
 const { init, startHttp } = require( `${appRoot}/app` )
 
 const expect = chai.expect
@@ -11,11 +12,11 @@ const expect = chai.expect
 const knex = require( `${appRoot}/db/knex` )
 const { createUser } = require( `${appRoot}/modules/core/services/users` )
 
-const { createAndSendInvite, getInviteById, getInviteByEmail, validateInvite, useInvite } = require( `${appRoot}/modules/serverinvites/services` )
+const { createAndSendInvite, getInviteById, getInviteByEmail, validateInvite, useInvite, sanitizeMessage } = require( `${appRoot}/modules/serverinvites/services` )
 const { createStream, getStream, getStreamUsers, getUserStreams } = require( `${appRoot}/modules/core/services/streams` )
 const { createPersonalAccessToken } = require( `${appRoot}/modules/core/services/tokens` )
 
-const serverAddress = `http://localhost:${process.env.PORT || 3000}`
+const serverAddress = 'http://localhost:3300'
 
 describe( 'Server Invites @server-invites', ( ) => {
 
@@ -55,30 +56,51 @@ describe( 'Server Invites @server-invites', ( ) => {
 
       try {
         await createAndSendInvite( { email:'cat@speckle.systems', inviterId: actor.id, message: 'Hey, join!' } )
-        assert.fail()
       } catch ( e ) {
-      // pass
+        return
       }
+      assert.fail( 'should not allow multiple invites for the same email' )
     } )
 
     it( 'should not allow self invites', async() => {
 
       try {
         await createAndSendInvite( { email: 'didimitrie-100@gmail.com', inviterId: actor.id } )
-        assert.fail()
       } catch ( e ) {
-      // pass
+        return
       }
+      assert.fail( 'should not allow self invites' )
     } )
 
     it( 'should not allow invites from no user', async() => {
 
       try {
         await createAndSendInvite( { email: 'didimitrie233-100@gmail.com', inviterId: 'fake' } )
-        assert.fail()
       } catch ( e ) {
-      // pass
+        return
       }
+      assert.fail( 'should not allow invites from no user' )
+    } )
+
+    it( 'should not allow invites with a too long message', async() => {
+
+      try {
+        let inviteId = await createAndSendInvite( {
+          email: '123456@gmail.com',
+          inviterId: actor.id,
+          message: longInviteMessage
+        } )
+      } catch ( e ){
+        return
+      }
+
+      assert.fail( 'created invite with too long message' )
+    } )
+
+    it( 'should sanitize invite messages', async() => {
+      let clean = sanitizeMessage( 'Click on my <b><a href="https://spam.com">spam link please</a></b>!' )
+      const includesLink = clean.includes( '<a' )
+      expect( includesLink ).to.be.false
     } )
 
     it( 'should get an invite by id', async() => {
@@ -157,62 +179,61 @@ describe( 'Server Invites @server-invites', ( ) => {
   } )
 
   // TODO: reinstate these tests; not sure why they pass locally and fail on CI
-  // describe( 'API @server-invites-api', () => {
-  //   let actor = {
-  //     name: 'Dimitrie Stefanescu',
-  //     email: 'didimitrie-10000@gmail.com',
-  //     password: 'wtfwtfwtf'
-  //   }
+  describe( 'API @server-invites-api', () => {
+    let actor = {
+      name: 'Dimitrie Stefanescu',
+      email: 'didimitrie-10000@gmail.com',
+      password: 'wtfwtfwtf'
+    }
 
-  //   let testServer, testToken
+    let testServer, testToken
 
-  //   before( async() => {
-  //     // await knex.migrate.rollback( )
-  //     await knex.migrate.latest( )
+    before( async() => {
+      await knex.migrate.rollback( )
+      await knex.migrate.latest( )
 
-  //     // let { app } = await init()
-  //     try {
-  //       let { server } = await startHttp( myApp )
-  //       testServer = server
-  //     } catch ( e ) {}
+      let { app } = await init()
 
-  //     actor.id = await createUser( actor )
+      let { server } = await startHttp( myApp, 3300 )
+      testServer = server
 
-  //     testToken = `Bearer ${( await createPersonalAccessToken( actor.id, 'test token', [ 'users:invite' ] ) )}`
-  //   } )
+      actor.id = await createUser( actor )
 
-  //   after( async() => {
-  //     await knex.migrate.rollback( )
-  //     if ( testServer )
-  //       testServer.close()
-  //   } )
+      testToken = `Bearer ${( await createPersonalAccessToken( actor.id, 'test token', [ 'users:invite' ] ) )}`
+    } )
 
-  //   it( 'should create a server invite', async() => {
+    after( async() => {
+      await knex.migrate.rollback( )
+      if ( testServer )
+        testServer.close()
+    } )
 
-  //     const res = await sendRequest( testToken, {
-  //       query: 'mutation inviteToServer($input: ServerInviteCreateInput!) { serverInviteCreate( input: $input ) }',
-  //       variables: { input: { email: 'cabbages@speckle.systems', message: 'wow!' } }
-  //     } )
+    it( 'should create a server invite', async() => {
 
-  //     expect( res.body.errors ).to.not.exist
-  //     expect( res.body.data.serverInviteCreate ).to.equal( true )
-  //   } )
+      const res = await sendRequest( testToken, {
+        query: 'mutation inviteToServer($input: ServerInviteCreateInput!) { serverInviteCreate( input: $input ) }',
+        variables: { input: { email: 'cabbages@speckle.systems', message: 'wow!' } }
+      } )
 
-  //   it( 'should create a stream invite', async() => {
+      expect( res.body.errors ).to.not.exist
+      expect( res.body.data.serverInviteCreate ).to.equal( true )
+    } )
 
-  //     let stream = { name: 'test', description:'wow' }
-  //     stream.id = await createStream( { ...stream, ownerId: actor.id } )
+    it( 'should create a stream invite', async() => {
 
-  //     const res = await sendRequest( testToken, {
-  //       query: 'mutation inviteToStream($input: StreamInviteCreateInput!) { streamInviteCreate( input: $input ) }',
-  //       variables: { input: { email: 'peppers@speckle.systems', message: 'wow!', streamId: stream.id } }
-  //     } )
+      let stream = { name: 'test', description:'wow' }
+      stream.id = await createStream( { ...stream, ownerId: actor.id } )
 
-  //     expect( res.body.errors ).to.not.exist
-  //     expect( res.body.data.streamInviteCreate ).to.equal( true )
-  //   } )
+      const res = await sendRequest( testToken, {
+        query: 'mutation inviteToStream($input: StreamInviteCreateInput!) { streamInviteCreate( input: $input ) }',
+        variables: { input: { email: 'peppers@speckle.systems', message: 'wow!', streamId: stream.id } }
+      } )
 
-  // } )
+      expect( res.body.errors ).to.not.exist
+      expect( res.body.data.streamInviteCreate ).to.equal( true )
+    } )
+
+  } )
 } )
 
 function sendRequest( auth, obj, address = serverAddress ) {
@@ -220,3 +241,6 @@ function sendRequest( auth, obj, address = serverAddress ) {
   return chai.request( address ).post( '/graphql' ).set( 'Authorization', auth ).send( obj )
 
 }
+
+const longInviteMessage =
+  'Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur? At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis praesentium voluptatum deleniti atque corrupti quos dolores et quas molestias excepturi sint occaecati cupiditate non provident, similique sunt in culpa qui officia deserunt mollitia animi, id est laborum et dolorum fuga. Et harum quidem rerum facilis est et expedita distinctio. Nam libero tempore, cum soluta nobis est eligendi optio cumque nihil impedit quo minus id quod maxime placeat facere possimus, omnis voluptas assumenda est, omnis dolor repellendus. Temporibus autem quibusdam et aut officiis debitis aut rerum necessitatibus saepe eveniet ut et voluptates repudiandae sint et molestiae non recusandae. Itaque earum rerum hic tenetur a sapiente delectus, ut aut reiciendis voluptatibus maiores alias consequatur aut perferendis doloribus asperiores repellat.'
diff --git a/packages/server/modules/stats/graph/resolvers/stats.js b/packages/server/modules/stats/graph/resolvers/stats.js
new file mode 100644
index 000000000..706a4ce54
--- /dev/null
+++ b/packages/server/modules/stats/graph/resolvers/stats.js
@@ -0,0 +1,50 @@
+'use strict'
+const appRoot = require( 'app-root-path' )
+const { validateServerRole, validateScopes } = require( `${appRoot}/modules/shared` )
+const { getStreamHistory, getCommitHistory, getObjectHistory, getUserHistory, getTotalStreamCount, getTotalCommitCount, getTotalObjectCount, getTotalUserCount } = require( '../../services' )
+
+
+module.exports = {
+  Query: {
+    async serverStats( parent, args, context, info ) {
+
+      await validateServerRole( context, 'server:admin' )
+      await validateScopes( context.scopes, 'server:stats' )
+      return {}
+    }
+  },
+
+  ServerStats: {
+    async totalStreamCount() {
+      return await getTotalStreamCount()
+    },
+
+    async totalCommitCount() {
+      return await getTotalCommitCount()
+    },
+
+    async totalObjectCount() {
+      return await getTotalObjectCount()
+    },
+
+    async totalUserCount() {
+      return await getTotalUserCount()
+    },
+
+    async streamHistory() {
+      return await getStreamHistory()
+    },
+
+    async commitHistory() {
+      return await getCommitHistory()
+    },
+
+    async objectHistory() {
+      return await getObjectHistory()
+    },
+
+    async userHistory() {
+      return await getUserHistory()
+    }
+  }
+}
diff --git a/packages/server/modules/stats/graph/schemas/stats.gql b/packages/server/modules/stats/graph/schemas/stats.gql
new file mode 100644
index 000000000..17d940748
--- /dev/null
+++ b/packages/server/modules/stats/graph/schemas/stats.gql
@@ -0,0 +1,26 @@
+extend type Query {
+  serverStats: ServerStats!
+}
+
+type ServerStats {
+  totalStreamCount: Int!
+  totalCommitCount: Int!
+  totalObjectCount: Int!
+  totalUserCount: Int!
+  """
+  An array of objects currently structured as { created_month: Date, count: int }.
+  """
+  streamHistory: [JSONObject]
+  """
+  An array of objects currently structured as { created_month: Date, count: int }.
+  """
+  commitHistory: [JSONObject]
+  """
+  An array of objects currently structured as { created_month: Date, count: int }.
+  """
+  objectHistory: [JSONObject]
+  """
+  An array of objects currently structured as { created_month: Date, count: int }.
+  """
+  userHistory: [JSONObject]
+}
diff --git a/packages/server/modules/stats/index.js b/packages/server/modules/stats/index.js
new file mode 100644
index 000000000..57c102e85
--- /dev/null
+++ b/packages/server/modules/stats/index.js
@@ -0,0 +1,13 @@
+'use strict'
+let debug = require( 'debug' )
+const appRoot = require( 'app-root-path' )
+const { registerOrUpdateScope } = require( `${appRoot}/modules/shared` )
+
+exports.init = async ( app, options ) => {
+  debug( 'speckle:modules' )( '📊 Init stats module' )
+  // TODO
+}
+
+exports.finalize = async () => {
+  // TODO
+}
diff --git a/packages/server/modules/stats/services/index.js b/packages/server/modules/stats/services/index.js
new file mode 100644
index 000000000..54b9b58c0
--- /dev/null
+++ b/packages/server/modules/stats/services/index.js
@@ -0,0 +1,93 @@
+'use strict'
+const appRoot = require( 'app-root-path' )
+const knex = require( `${appRoot}/db/knex` )
+
+module.exports = {
+
+  async getTotalStreamCount() {
+    const query = 'SELECT COUNT(*) FROM streams'
+    const result = await knex.raw( query )
+    return parseInt( result.rows[0].count )
+  },
+
+  async getTotalCommitCount() {
+    const query = 'SELECT COUNT(*) FROM commits'
+    const result = await knex.raw( query )
+    return parseInt( result.rows[0].count )
+  },
+
+  async getTotalObjectCount() {
+    const query = 'SELECT COUNT(*) FROM objects'
+    const result = await knex.raw( query )
+    return parseInt( result.rows[0].count )
+  },
+
+  async getTotalUserCount() {
+    const query = 'SELECT COUNT(*) FROM users'
+    const result = await knex.raw( query )
+    return parseInt( result.rows[0].count )
+  },
+
+  async getStreamHistory() {
+    const query = `
+    SELECT
+      DATE_TRUNC('month', streams. "createdAt") AS created_month,
+      COUNT(id) AS count
+    FROM
+      streams
+    GROUP BY
+      DATE_TRUNC('month', streams. "createdAt")
+    `
+
+    const result = await knex.raw( query )
+    result.rows.forEach( row => row.count = parseInt( row.count ) )
+    return result.rows
+  },
+
+  async getCommitHistory() {
+    const query = `
+    SELECT
+      DATE_TRUNC('month', commits. "createdAt") AS created_month,
+      COUNT(id) AS count
+    FROM
+      commits
+    GROUP BY
+      DATE_TRUNC('month', commits. "createdAt")
+    `
+    const result = await knex.raw( query )
+    result.rows.forEach( row => row.count = parseInt( row.count ) )
+    return result.rows
+  },
+
+  async getObjectHistory() {
+    const query = `
+    SELECT
+      DATE_TRUNC('month', objects. "createdAt") AS created_month,
+      COUNT(id) AS count
+    FROM
+      objects
+    GROUP BY
+      DATE_TRUNC('month', objects. "createdAt")
+    `
+    const result = await knex.raw( query )
+    result.rows.forEach( row => row.count = parseInt( row.count ) )
+    return result.rows
+
+  },
+
+  async getUserHistory() {
+    const query = `
+    SELECT
+      DATE_TRUNC('month', users. "createdAt") AS created_month,
+      COUNT(id) AS count
+    FROM
+      users
+    GROUP BY
+      DATE_TRUNC('month', users. "createdAt")
+    `
+    const result = await knex.raw( query )
+    result.rows.forEach( row => row.count = parseInt( row.count ) )
+    return result.rows
+  },
+
+}
diff --git a/packages/server/modules/stats/tests/stats.spec.js b/packages/server/modules/stats/tests/stats.spec.js
new file mode 100644
index 000000000..89ccfc1f2
--- /dev/null
+++ b/packages/server/modules/stats/tests/stats.spec.js
@@ -0,0 +1,263 @@
+/* istanbul ignore file */
+const chai = require( 'chai' )
+const chaiHttp = require( 'chai-http' )
+const assert = require( 'assert' )
+
+const appRoot = require( 'app-root-path' )
+const { init, startHttp } = require( `${appRoot}/app` )
+const knex = require( `${appRoot}/db/knex` )
+
+const expect = chai.expect
+chai.use( chaiHttp )
+
+const crypto = require( 'crypto' )
+const { createUser } = require( `${appRoot}/modules/core/services/users` )
+const { createPersonalAccessToken } = require( `${appRoot}/modules/core/services/tokens` )
+const { createStream } = require( `${appRoot}/modules/core/services/streams` )
+const { createObjects } = require( `${appRoot}/modules/core/services/objects` )
+const { createCommitByBranchName, createCommitByBranchId } = require( `${appRoot}/modules/core/services/commits` )
+
+const { getStreamHistory, getCommitHistory, getObjectHistory, getUserHistory, getTotalStreamCount, getTotalCommitCount, getTotalObjectCount, getTotalUserCount } = require( '../services' )
+
+const params = { numUsers: 25, numStreams: 30, numObjects: 100, numCommits: 100 }
+
+describe( 'Server stats services @stats-services', function() {
+
+  before( async function() {
+    this.timeout( 10000 )
+
+    await knex.migrate.rollback( )
+    await knex.migrate.latest( )
+
+    await init()
+    await seedDb( params )
+  } )
+
+  after( async() => {
+    await knex.migrate.rollback( )
+  } )
+
+  it( 'should return the total number of users on this server', async () => {
+    let res = await getTotalUserCount()
+    expect( res ).to.equal( params.numUsers )
+  } )
+
+  it( 'should return the total number of streams on this server', async() => {
+    let res = await getTotalStreamCount()
+    expect( res ).to.equal( params.numStreams )
+  } )
+
+  it( 'should return the total number of commits on this server', async() => {
+    let res = await getTotalCommitCount()
+    expect( res ).to.equal( params.numCommits )
+  } )
+
+  it( 'should return the total number of objects on this server', async() => {
+    let res = await getTotalObjectCount()
+    expect( res ).to.equal( params.numObjects )
+  } )
+
+  it( 'should return the stream creation history by month', async() => {
+    let res = await getStreamHistory()
+    expect( res ).to.be.an( 'array' )
+    expect( res[0] ).to.have.property( 'count' )
+    expect( res[0] ).to.have.property( 'created_month' )
+    expect( res[0].count ).to.be.a( 'number' )
+    expect( res[0].count ).to.equal( params.numStreams )
+  } )
+
+  it( 'should return the commit creation history by month', async() => {
+    let res = await getCommitHistory()
+    expect( res ).to.be.an( 'array' )
+    expect( res[0] ).to.have.property( 'count' )
+    expect( res[0] ).to.have.property( 'created_month' )
+    expect( res[0].count ).to.be.a( 'number' )
+    expect( res[0].count ).to.equal( params.numCommits )
+  } )
+
+  it( 'should return the object creation history by month', async() => {
+    let res = await getObjectHistory()
+    expect( res ).to.be.an( 'array' )
+    expect( res[0] ).to.have.property( 'count' )
+    expect( res[0] ).to.have.property( 'created_month' )
+    expect( res[0].count ).to.be.a( 'number' )
+    expect( res[0].count ).to.equal( params.numObjects )
+  } )
+
+  it( 'should return the user creation history by month', async() => {
+    let res = await getUserHistory()
+    expect( res ).to.be.an( 'array' )
+    expect( res[0] ).to.have.property( 'count' )
+    expect( res[0] ).to.have.property( 'created_month' )
+    expect( res[0].count ).to.be.a( 'number' )
+    expect( res[0].count ).to.equal( params.numUsers )
+  } )
+
+} )
+
+let addr = `http://localhost:3333`
+
+describe( 'Server stats api @stats-api', function() {
+  let testServer
+  let adminUser = {
+    name: 'Dimitrie',
+    password: 'TestPasswordSecure',
+    email: 'spam@spam.spam'
+  }
+
+  let notAdminUser = {
+    name: 'Andrei',
+    password: 'TestPasswordSecure',
+    email: 'spasm@spam.spam'
+  }
+
+  let fullQuery = `
+  query{
+    serverStats{
+      totalStreamCount
+      totalCommitCount
+      totalObjectCount
+      totalUserCount
+      streamHistory
+      commitHistory
+      objectHistory
+      userHistory
+      }
+    }
+    `
+
+  before( async function() {
+    this.timeout( 10000 )
+    await knex.migrate.rollback( )
+    await knex.migrate.latest( )
+
+    let { app } = await init( )
+    let { server } = await startHttp( app, 3333 )
+    testServer = server
+
+    adminUser.id = await createUser( adminUser )
+    adminUser.goodToken = `Bearer ${( await createPersonalAccessToken( adminUser.id, 'test token user A', [ 'server:stats' ] ) )}`
+    adminUser.badToken = `Bearer ${( await createPersonalAccessToken( adminUser.id, 'test token user A', [ 'streams:read' ] ) )}`
+
+    notAdminUser.id = await createUser( notAdminUser )
+    notAdminUser.goodToken = `Bearer ${( await createPersonalAccessToken( notAdminUser.id, 'test token user A', [ 'server:stats' ] ) )}`
+    notAdminUser.badToken = `Bearer ${( await createPersonalAccessToken( notAdminUser.id, 'test token user A', [ 'streams:read' ] ) )}`
+
+    await seedDb( params )
+
+  } )
+
+  after( async function() {
+    await knex.migrate.rollback( )
+    testServer.close( )
+  } )
+
+  it( 'Should not get stats if user is not admin', async() => {
+
+    let res = await sendRequest( adminUser.badToken, { query: fullQuery } )
+    expect( res.body.errors ).to.exist
+    expect( res.body.errors[0].extensions.code ).to.equal( 'FORBIDDEN' )
+
+  } )
+
+  it( 'Should not get stats if user is not admin even if the token has the correct scopes', async() => {
+    let res = await sendRequest( notAdminUser.goodToken, { query: fullQuery } )
+    expect( res.body.errors ).to.exist
+    expect( res.body.errors[0].extensions.code ).to.equal( 'FORBIDDEN' )
+  } )
+
+  it( 'Should not get stats if token does not have required scope', async() => {
+    let res = await sendRequest( adminUser.badToken, { query: fullQuery } )
+    expect( res ).to.be.json
+    expect( res.body.errors ).to.exist
+    expect( res.body.errors[0].extensions.code ).to.equal( 'FORBIDDEN' )
+  } )
+
+  it( 'Should get server stats', async() => {
+    let res = await sendRequest( adminUser.goodToken, { query: fullQuery } )
+    expect( res ).to.be.json
+    expect( res.body.errors ).to.not.exist
+
+    expect( res.body.data ).to.have.property( 'serverStats' )
+    expect( res.body.data.serverStats ).to.have.property( 'totalStreamCount' )
+    expect( res.body.data.serverStats ).to.have.property( 'totalCommitCount' )
+    expect( res.body.data.serverStats ).to.have.property( 'totalObjectCount' )
+    expect( res.body.data.serverStats ).to.have.property( 'totalUserCount' )
+    expect( res.body.data.serverStats ).to.have.property( 'streamHistory' )
+    expect( res.body.data.serverStats ).to.have.property( 'commitHistory' )
+    expect( res.body.data.serverStats ).to.have.property( 'userHistory' )
+
+    expect( res.body.data.serverStats.totalStreamCount ).to.equal( params.numStreams )
+    expect( res.body.data.serverStats.totalCommitCount ).to.equal( params.numCommits )
+    expect( res.body.data.serverStats.totalObjectCount ).to.equal( params.numObjects )
+    expect( res.body.data.serverStats.totalUserCount ).to.equal( params.numUsers + 2 ) // we're registering two extra users in the before hook
+
+    expect( res.body.data.serverStats.streamHistory ).to.be.an( 'array' )
+    expect( res.body.data.serverStats.commitHistory ).to.be.an( 'array' )
+    expect( res.body.data.serverStats.userHistory ).to.be.an( 'array' )
+
+  } )
+
+} )
+
+async function seedDb( { numUsers = 10, numStreams = 10, numObjects = 10, numCommits = 10 } = {} ) {
+  let users = []
+  let streams = []
+
+  // create users
+  for ( let i = 0; i < numUsers; i++ ) {
+    let id = await createUser( { name: `User ${i}`, password: `SuperSecure${i}${i*3.14}`, email: `user${i}@speckle.systems` } )
+    users.push( id )
+  }
+
+  // create streams
+  for ( let i = 0; i < numStreams; i++ ) {
+    let id = await createStream( { name: `Stream ${i}`, ownerId: users[i >= users.length ? users.length - 1 : i ] } )
+    streams.push( id )
+  }
+
+  // create a objects
+  let mockObjects = createManyObjects( numObjects - 1 )
+  let objs = await createObjects( streams[ 0 ], mockObjects )
+  let commits = []
+
+  // create commits referencing those objects
+  for ( let i = 0; i < numCommits; i++ ) {
+    let id = await createCommitByBranchName( {
+      streamId: streams[0],
+      branchName: 'main',
+      sourceApplication: 'tests',
+      objectId: objs[ i >= objs.length ? objs.length - 1 : i ]
+    } )
+    commits.push( id )
+  }
+
+}
+
+function createManyObjects( num, noise ) {
+  num = num || 10000
+  noise = noise || Math.random( ) * 100
+
+  let objs = [ ]
+
+  let base = { name: 'base bastard 2', noise: noise, __closure: {} }
+  objs.push( base )
+  let k = 0
+
+  for ( let i = 0; i < num; i++ ) {
+    let baby = { name: `mr. ${i}`, nest: { duck: i % 2 === 0, mallard: 'falsey', arr: [ i + 42, i, i ] } }
+    getAnId( baby )
+    base.__closure[ baby.id ] = 1
+    objs.push( baby )
+  }
+  getAnId( base )
+  return objs
+}
+
+function getAnId( obj ) {
+  obj.id = obj.id || crypto.createHash( 'md5' ).update( JSON.stringify( obj ) ).digest( 'hex' )
+}
+
+function sendRequest( auth, obj, address = addr ) {
+  return chai.request( address ).post( '/graphql' ).set( 'Authorization', auth ).send( obj )
+}
diff --git a/packages/server/package-lock.json b/packages/server/package-lock.json
index 603e828bb..846ed5e9d 100644
--- a/packages/server/package-lock.json
+++ b/packages/server/package-lock.json
@@ -4498,6 +4498,11 @@
 			"integrity": "sha1-s2nW+128E+7PUk+RsHD+7cNXzzQ=",
 			"dev": true
 		},
+		"deepmerge": {
+			"version": "4.2.2",
+			"resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+			"integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg=="
+		},
 		"default-require-extensions": {
 			"version": "3.0.0",
 			"resolved": "https://registry.npmjs.org/default-require-extensions/-/default-require-extensions-3.0.0.tgz",
@@ -4666,6 +4671,39 @@
 				"esutils": "^2.0.2"
 			}
 		},
+		"dom-serializer": {
+			"version": "1.3.2",
+			"resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-1.3.2.tgz",
+			"integrity": "sha512-5c54Bk5Dw4qAxNOI1pFEizPSjVsx5+bpJKmL2kPn8JhBUq2q09tTCa3mjijun2NfK78NMouDYNMBkOrPZiS+ig==",
+			"requires": {
+				"domelementtype": "^2.0.1",
+				"domhandler": "^4.2.0",
+				"entities": "^2.0.0"
+			}
+		},
+		"domelementtype": {
+			"version": "2.2.0",
+			"resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.2.0.tgz",
+			"integrity": "sha512-DtBMo82pv1dFtUmHyr48beiuq792Sxohr+8Hm9zoxklYPfa6n0Z3Byjj2IV7bmr2IyqClnqEQhfgHJJ5QF0R5A=="
+		},
+		"domhandler": {
+			"version": "4.2.0",
+			"resolved": "https://registry.npmjs.org/domhandler/-/domhandler-4.2.0.tgz",
+			"integrity": "sha512-zk7sgt970kzPks2Bf+dwT/PLzghLnsivb9CcxkvR8Mzr66Olr0Ofd8neSbglHJHaHa2MadfoSdNlKYAaafmWfA==",
+			"requires": {
+				"domelementtype": "^2.2.0"
+			}
+		},
+		"domutils": {
+			"version": "2.7.0",
+			"resolved": "https://registry.npmjs.org/domutils/-/domutils-2.7.0.tgz",
+			"integrity": "sha512-8eaHa17IwJUPAiB+SoTYBo5mCdeMgdcAoXJ59m6DT1vw+5iLS3gNoqYaRowaBKtGVrOF1Jz4yDTgYKLK2kvfJg==",
+			"requires": {
+				"dom-serializer": "^1.0.1",
+				"domelementtype": "^2.2.0",
+				"domhandler": "^4.2.0"
+			}
+		},
 		"dot-prop": {
 			"version": "4.2.1",
 			"resolved": "https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.1.tgz",
@@ -4798,6 +4836,11 @@
 				"ansi-colors": "^4.1.1"
 			}
 		},
+		"entities": {
+			"version": "2.2.0",
+			"resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
+			"integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A=="
+		},
 		"env-paths": {
 			"version": "2.2.0",
 			"resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.0.tgz",
@@ -6794,6 +6837,17 @@
 			"integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
 			"dev": true
 		},
+		"htmlparser2": {
+			"version": "6.1.0",
+			"resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-6.1.0.tgz",
+			"integrity": "sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==",
+			"requires": {
+				"domelementtype": "^2.0.1",
+				"domhandler": "^4.0.0",
+				"domutils": "^2.5.2",
+				"entities": "^2.0.0"
+			}
+		},
 		"http-cache-semantics": {
 			"version": "3.8.1",
 			"resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz",
@@ -7834,6 +7888,11 @@
 			"resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
 			"integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="
 		},
+		"klona": {
+			"version": "2.0.4",
+			"resolved": "https://registry.npmjs.org/klona/-/klona-2.0.4.tgz",
+			"integrity": "sha512-ZRbnvdg/NxqzC7L9Uyqzf4psi1OM4Cuc+sJAkQPjO6XkQIJTNbfK2Rsmbw8fx1p2mkZdp2FZYo2+LwXYY/uwIA=="
+		},
 		"knex": {
 			"version": "0.21.15",
 			"resolved": "https://registry.npmjs.org/knex/-/knex-0.21.15.tgz",
@@ -8830,6 +8889,11 @@
 			"integrity": "sha512-M2ufzIiINKCuDfBSAUr1vWQ+vuVcA9kqx8JJUsbQi6yf1uGRyb7HfpdfUr5qLXf3B/t8dPvcjhKMmlfnP47EzQ==",
 			"optional": true
 		},
+		"nanoid": {
+			"version": "3.1.23",
+			"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.1.23.tgz",
+			"integrity": "sha512-FiB0kzdP0FFVGDKlRLEQ1BgDzU87dy5NnzjeW9YZNt+/c3+q82EQDUwniSAUxp/F0gFNI1ZhKU1FqYsMuqZVnw=="
+		},
 		"nanomatch": {
 			"version": "1.2.13",
 			"resolved": "https://registry.npmjs.org/nanomatch/-/nanomatch-1.2.13.tgz",
@@ -9776,6 +9840,11 @@
 				"protocols": "^1.4.0"
 			}
 		},
+		"parse-srcset": {
+			"version": "1.0.2",
+			"resolved": "https://registry.npmjs.org/parse-srcset/-/parse-srcset-1.0.2.tgz",
+			"integrity": "sha1-8r0iH2zJcKk42IVWq8WJyqqiveE="
+		},
 		"parse-url": {
 			"version": "5.0.2",
 			"resolved": "https://registry.npmjs.org/parse-url/-/parse-url-5.0.2.tgz",
@@ -10073,6 +10142,23 @@
 			"resolved": "https://registry.npmjs.org/posix-character-classes/-/posix-character-classes-0.1.1.tgz",
 			"integrity": "sha1-AerA/jta9xoqbAL+q7jB/vfgDqs="
 		},
+		"postcss": {
+			"version": "8.3.0",
+			"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.3.0.tgz",
+			"integrity": "sha512-+ogXpdAjWGa+fdYY5BQ96V/6tAo+TdSSIMP5huJBIygdWwKtVoB5JWZ7yUd4xZ8r+8Kvvx4nyg/PQ071H4UtcQ==",
+			"requires": {
+				"colorette": "^1.2.2",
+				"nanoid": "^3.1.23",
+				"source-map-js": "^0.6.2"
+			},
+			"dependencies": {
+				"colorette": {
+					"version": "1.2.2",
+					"resolved": "https://registry.npmjs.org/colorette/-/colorette-1.2.2.tgz",
+					"integrity": "sha512-MKGMzyfeuutC/ZJ1cba9NqcNpfeqMUcYmyF1ZFY6/Cn7CNSAKx6a+s48sqLqyAiZuaP2TcqMhoo+dlwFnVxT9w=="
+				}
+			}
+		},
 		"postgres-array": {
 			"version": "2.0.0",
 			"resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -10863,6 +10949,32 @@
 			"resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
 			"integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
 		},
+		"sanitize-html": {
+			"version": "2.4.0",
+			"resolved": "https://registry.npmjs.org/sanitize-html/-/sanitize-html-2.4.0.tgz",
+			"integrity": "sha512-Y1OgkUiTPMqwZNRLPERSEi39iOebn2XJLbeiGOBhaJD/yLqtLGu6GE5w7evx177LeGgSE+4p4e107LMiydOf6A==",
+			"requires": {
+				"deepmerge": "^4.2.2",
+				"escape-string-regexp": "^4.0.0",
+				"htmlparser2": "^6.0.0",
+				"is-plain-object": "^5.0.0",
+				"klona": "^2.0.3",
+				"parse-srcset": "^1.0.2",
+				"postcss": "^8.0.2"
+			},
+			"dependencies": {
+				"escape-string-regexp": {
+					"version": "4.0.0",
+					"resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+					"integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA=="
+				},
+				"is-plain-object": {
+					"version": "5.0.0",
+					"resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
+					"integrity": "sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q=="
+				}
+			}
+		},
 		"sax": {
 			"version": "1.2.4",
 			"resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
@@ -11245,6 +11357,11 @@
 			"resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
 			"integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w="
 		},
+		"source-map-js": {
+			"version": "0.6.2",
+			"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-0.6.2.tgz",
+			"integrity": "sha512-/3GptzWzu0+0MBQFrDKzw/DvvMTUORvgY6k6jd/VS6iCR4RDTKWH6v6WPwQoUO8667uQEf9Oe38DxAYWY5F/Ug=="
+		},
 		"source-map-resolve": {
 			"version": "0.5.3",
 			"resolved": "https://registry.npmjs.org/source-map-resolve/-/source-map-resolve-0.5.3.tgz",
diff --git a/packages/server/package.json b/packages/server/package.json
index 19ce60c1c..a0e8ca964 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -60,6 +60,7 @@
     "pg-query-stream": "^3.4.2",
     "prom-client": "^13.1.0",
     "redis": "^3.1.1",
+    "sanitize-html": "^2.4.0",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {
diff --git a/packages/viewer/src/modules/Converter.js b/packages/viewer/src/modules/Converter.js
index 9880fe69e..0f9ac268a 100644
--- a/packages/viewer/src/modules/Converter.js
+++ b/packages/viewer/src/modules/Converter.js
@@ -91,6 +91,7 @@ export default class Coverter {
     // Last attempt: iterate through all object keys and see if we can display anything!
     // traverses the object in case there's any sub-objects we can convert.
     for ( let prop in target ) {
+      if ( prop === 'bbox' ) continue
       if ( typeof target[prop] !== 'object' ) continue
       let childPromise = this.traverseAndConvert( target[prop], callback, scale )
       childrenConversionPromisses.push( childPromise )
@@ -363,6 +364,20 @@ export default class Coverter {
     return new ObjectWrapper( geometry, obj, 'line' )
   }
 
+  async BoxToBufferGeometry( object, scale = true ){
+    let conversionFactor = scale ? getConversionFactor( object.units ) : 1
+
+    var move = this.PointToVector3( object.basePlane.origin )
+    var width = ( object.xSize.end - object.xSize.start ) * conversionFactor
+    var depth = ( object.ySize.end - object.ySize.start ) * conversionFactor
+    var height = ( object.zSize.end - object.zSize.start ) * conversionFactor
+
+    var box = new THREE.BoxBufferGeometry( width,height,depth,1,1,1 )
+    box.applyMatrix4( new THREE.Matrix4().setPosition( move ) )
+    
+    return new ObjectWrapper( box, object )
+  }
+
   async PolycurveToBufferGeometry( object, scale = true ) {
     let obj = {}
     Object.assign( obj, object )