Security

1. Signing in

• Passwords are stored hashed, never in a form we can read.
• Two-factor authentication and passkeys are available to every user, on every plan.
• Sign-in and password-reset attempts are rate-limited.

2. Who can do what

Roles and permissions decide what each teammate can see and change, and the workspace owner controls them. Actions taken through the API are recorded in an audit trail, and API tokens can be limited to specific abilities and to a list of allowed IP addresses.

3. Keeping workspaces apart

Every record carries the workspace it belongs to, and every query is scoped to the workspace of the person making it. That scoping is enforced in the framework itself rather than remembered case by case, which is what makes it dependable.

4. Data in transit and at rest

Traffic to the platform is encrypted with TLS. Credentials for connected channels and integrations, and webhook signing secrets, are encrypted in the database with a key held outside it.

5. Webhooks and the public API

Outgoing webhooks are signed so you can verify they came from us. Requests we make on your behalf — crawling a website for a knowledge base, calling a URL from a flow — are checked to make sure they cannot be pointed at private infrastructure.

6. What we do not claim

We hold no SOC 2 or ISO 27001 certification today, and we do not offer a contractual uptime guarantee. If either matters to your procurement, ask us where we are rather than assuming.

7. Reporting something

If you find a vulnerability, write to ⁦[email protected]⁩ with enough detail to reproduce it. We review every report and reply to it, and will not pursue researchers who report responsibly and stay out of other people's data.