Trust Center

Encryption in transit

All connections use TLS 1.2 or higher, with TLS 1.3 preferred. HTTP is redirected to HTTPS and HSTS is preloaded with a one year max-age across subdomains.

Encryption at rest

Managed databases and object storage are encrypted at rest. Secrets, webhook signing keys, and backups are additionally sealed with AES-256-GCM envelopes.

Authenticated file access

Uploaded files live in private object storage and are served only through short-lived signed URLs, so raw storage locations are never exposed to clients.

Key management and rotation

Signing keys and credentials live in environment configuration, never in source code, and rotate on a fixed schedule with overlap windows so rotation never drops live traffic.

Passwordless sign-in

One-time email codes and magic links remove password reuse and phishing risk.

Passkeys and security keys

WebAuthn passkeys, hardware security keys, and device biometrics are fully supported.

Two-factor authentication

Authenticator-app (TOTP) and optional SMS two-factor, with encrypted recovery codes.

Single sign-on and provisioning

Per-organization OpenID Connect single sign-on, including Microsoft Entra and Google, with SCIM directory provisioning and deprovisioning.

Step-up verification

Sensitive actions re-verify your identity within a short window before they proceed.

Session protection

Sessions use signed, HTTP-only tokens with cross-site and origin binding, key-id pinning, a revocation deny-list, and a cap on concurrent sessions. You can review and revoke devices.

Anomaly detection

New-device sign-ins are flagged and email-notified, and repeated failed logins trigger graduated account lockout.

Role-based access

Project access is governed by five roles (owner, admin, manager, editor, viewer), and every action enforces the role it requires.

Tenant isolation

Customer data is logically isolated and scoped to your account and project membership. Cross-tenant access attempts are denied and logged.

Administrative allowlist

Operator tooling is restricted to an explicit allowlist and guarded separately from customer roles.

Enterprise policy controls

Organizations can require phishing-resistant factors, set session and idle timeouts and lockout thresholds, and enforce single sign-on that disables local credentials.

Tamper-evident audit log

Security-relevant actions are written to a tamper-evident log with actor, IP, user agent, and context, sealed with an HMAC hash chain so any later alteration is detectable.

Activity history

Every mutating project operation is recorded to an append-only activity trail, retained on a plan-based schedule.

Error and anomaly monitoring

Errors and anomalies are monitored continuously, and personal data is scrubbed from diagnostics before it leaves the system.

Continuously verified controls

Core controls (security headers, audit-log integrity, step-up verification, rate limiting, and PII scrubbing) are asserted by an automated control-test suite that runs in CI on every change.

Independent penetration test

An independent third-party penetration test is planned to complement our automated control suite and internal threat modeling.

Web application firewall

Requests matching known scanner, path-traversal, and injection signatures are blocked and logged.

Layered rate limiting

Per-IP, per-key, and per-endpoint rate limits protect authentication and sensitive operations, and abusive bursts back off automatically.

Edge protection

An enterprise edge network provides DDoS protection and bot mitigation, with automated checks against fraudulent account creation.

Input validation

Inputs are schema-validated at every boundary and database queries are parameterized, so untrusted input is never interpreted as code.

Content Security Policy

A strict Content Security Policy restricts script execution and resource loading in the browser.

Server-side request forgery protection

Outbound destinations (webhooks and imports) are validated against private and metadata addresses, defeating server-side request forgery and DNS rebinding.

File upload safeguards

Uploads are validated by declared type and size, rejected when they carry executable or archive-bomb signatures, and stored under unguessable random keys in private storage reachable only through short-lived signed URLs.

Safe error handling

Internal error details are never returned to clients. Failures are logged securely for review.

Dependency hygiene

Dependencies are kept current and reviewed, and production code is type-checked and tested in CI before it ships.

Threat modeling

The platform is threat-modeled with STRIDE across its trust boundaries (accounts, API keys, sessions, webhooks, and the admin surface), and mitigations are tracked per identified threat.

API key security

Keys are stored only as a peppered one-way hash (HMAC-SHA256, with the pepper held outside the database) and compared in constant time. The secret is shown once and is never retrievable. Keys are least-privilege scoped with separate test and live environments.

Key access controls

Optional IP allowlists, origin-bound browser keys, per-key rate limits, and customer spend caps with automatic suspension protect against runaway use and abuse.

Signed webhooks

Outbound webhooks are HMAC-signed with secrets encrypted at rest. Destinations are validated to block internal and private network addresses.

Read-only connectors

The Model Context Protocol interface is read-only and scope-gated under the same key model, so it cannot mutate your data.

Sandboxed AI-generated queries

When enabled, AI-generated database queries run as a read-only role limited to SELECT on approved tables, with statement timeouts and row caps. Generated values are always parameterized.

Query validation

When enabled, AI-generated query output is parsed and rejected if it contains writes, system functions, comments, or multiple statements.

Prompt-injection defenses

When enabled, connector and document content is treated as untrusted. Sensitive fields are excluded and outputs are validated before use.

No training on your data

Content sent to our AI provider is used only to produce your result and, under the provider's terms, is not used to train its models.

US data residency

Data is processed and stored in the United States.

Data minimization

We collect only what is needed to run the service and avoid unnecessary tracking.

Export and erasure

You can export your data, and on account deletion customer data is removed within 30 days and encrypted backups are purged within 90 days, except where law requires retention.

Privacy rights

We support access, correction, deletion, and portability, and honor California rights to opt out of the sale or sharing of personal data.

PII protection in logs

Email, IP, and credentials are masked or scrubbed from logs and diagnostics.

Data classification

Data is classified across four levels (public, internal, sensitive personal data, and critical). Critical secrets are never logged or exported, and sensitive personal data is access-logged, retention-limited, and pseudonymized in analytics.

Privacy impact assessments

High-risk processing is assessed before launch. Location tracking is consent-based: the tracked person must explicitly accept an invite before any position is recorded.

Enterprise hosting

The service runs on managed cloud infrastructure with global edge delivery and automatic failover.

Backups and recovery

Managed databases provide continuous backups and point-in-time recovery. Encrypted backups run daily, with a documented restore-and-recovery drill.

Incident response

A severity-tiered incident process with defined response targets, plus breach notification in line with applicable law and our Data Processing Agreement.

Live status monitoring

Uptime is monitored by an external service against a public health endpoint, and current status and incident history are published on our status page.

Recovery objectives

Defined recovery targets per scenario: a 24 hour recovery point and 4 hour recovery time for data restores, with automatic database failover and a 30 minute recovery time for a region outage.