Security & Privacy

​

Data Storage

​

Primary Database

• Encryption at rest: All data encrypted using AES-256
• Encryption in transit: TLS 1.3 for all connections
• Row-Level Security (RLS): Every table has RLS policies ensuring users only access their own data
• Backups: Daily automated backups with point-in-time recovery

​

User Data Isolation

-- Example RLS policy
CREATE POLICY "users_own_data" ON initiatives
  FOR ALL USING (
    owner_id = auth.uid() OR
    workspace_id IN (
      SELECT workspace_id FROM workspace_members
      WHERE user_id = auth.uid()
    )
  );

​

Authentication

​

User Authentication

• Email/password with strong password requirements
• Google OAuth
• Passkey support (WebAuthn)
• Multi-factor authentication (MFA) available

​

API Authentication

​

Session Management

• Sessions expire after 7 days of inactivity
• Concurrent sessions allowed (configurable)
• Remote session revocation available in settings

​

Secrets Management

​

Integration Tokens

​

Key Rotation

​

Access Controls

​

Role-Based Access

​

Permission Boundaries

• Agents only access data explicitly granted via scopes
• MCP tools declare required permissions
• Audit log tracks all permission-sensitive actions

​

Agent Security

​

Autonomy Limits

interface AgentLimits {
  max_tokens_per_run: number; // Prevent runaway costs
  max_tool_calls: number; // Prevent infinite loops
  allowed_tools: string[]; // Whitelist of tools
  budget_threshold: number; // $$ limit before escalation
}

​

Tool Gating

// Tools are gated by scope and policy
const registry = buildPolicyAwareToolRegistry({
  requestedTools: ['github.create_pr'],
  grantedScopes: user.scopes, // Must include 'github:write'
  projectId: project.id,
});

​

Verification Layer

1. Citation check (sources exist and are accessible)
2. Policy check (no PII, no secrets, brand compliant)
3. Contract check (output matches expected schema)
4. Budget check (within token/latency limits)

​

Audit Trail

​

What We Log

​

Retention

​

Access to Logs

• Mission Control: View recent activity
• Settings → Audit Log: Full searchable history
• Export: Download logs for compliance reviews

​

Network Security

​

Infrastructure

• Hetzner: Application and agent runtime hosting
• Cloudflare: MCP server, edge protection, DDoS mitigation, and WAF
• Supabase: Managed Postgres with network isolation

​

Security Headers

// middleware.ts
headers.set('X-Content-Type-Options', 'nosniff');
headers.set('X-Frame-Options', 'DENY');
headers.set('X-XSS-Protection', '1; mode=block');
headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
headers.set('Content-Security-Policy', CSP_POLICY);

​

Rate Limiting

​

Incident Response

​

Response Process

1. Detection: Automated monitoring + user reports
2. Triage: Severity assessment within 1 hour
3. Containment: Immediate action to limit impact
4. Resolution: Root cause fix and deployment
5. Communication: User notification if data affected
6. Review: Post-incident analysis and improvements

​

Contact

​

Compliance Roadmap

​

Current State

​

Data Processing

• Subprocessors: Hetzner, Cloudflare, Supabase, Stripe, OpenAI
• Data location: Primary application/runtime infrastructure on Hetzner; managed data storage in Supabase; enterprise region commitments available on request
• DPA: Available on request for enterprise customers

​

Your Rights

• Export all your data (Settings → Export)
• Delete your account and data (Settings → Account)
• Correct inaccurate data (Settings → Profile)
• Restrict processing (contact support)

​

Best Practices

​

Questions?