Skip to content
Email Justin

Compliance / Trust / Last updated July 1, 2026

Security & Compliance

A plain view of the controls in the product today: tenant isolation, passwordless access, connector token handling, audit evidence, and the gates we use before regulated data goes live.

Tenant isolation

Every workspace is keyed by organization. That key follows app requests, operator runs, tool execution, memory, and database reads. Tenant tables use Supabase row-level security, so isolation is enforced below the UI layer.

Controls in the product

  • Tenant isolation: organization_id is carried through app requests, operator runs, tool calls, memory, and database reads. Supabase RLS enforces the boundary in Postgres.
  • Passwordless access: users sign in with one-time codes or Google OAuth. The product has no password login, reset flow, or stored product password.
  • Connector tokens: customer OAuth tokens stay in the connector vault where possible. The app stores connection references and non-secret metadata.
  • Secrets: custom tool credentials are encrypted through Supabase Vault patterns and kept out of logs.
  • Audit trail: sensitive writes record actor, organization, target, cause, and request context. Audit exports go to S3 Object Lock for WORM retention evidence.
  • Human approval: workflows can pause before sending messages, changing records, or calling external systems.
  • PHI artifacts: generated artifacts for PHI-classified organizations are not exposed through public share links.
  • Web surface: security headers, restrictive CSP, Turnstile-protected auth starts, and server-side rate limits protect the public app.

Compliance posture

  • SOC 2: controls are in place and evidence is being collected. A completed SOC 2 report is not available yet.
  • HIPAA: PHI workspaces stay off until the customer BAA and required subprocessor coverage are signed and verified.
  • SEC recordkeeping: immutable audit exports support a regulated record trail. Customers remain responsible for their own filing and retention duties.
  • GDPR/CCPA: export, correction, deletion, and retention workflows are built into the product. Some records stay when law, security, accounting, or contract duties require retention.
  • AI governance: workflow templates carry risk classifications. Model processing is routed through AWS Bedrock for BAA-covered workloads.

Security contact

If you believe you found a security issue, email Justin with enough detail to reproduce it.