Security & Trust: A Business Overview

Your Data, Secured. We have built our platform from the ground up to exceed the security standards required by modern enterprise corporations.

1. Data Isolation & Multi-Tenancy Architecture

Unlike traditional application-layer security (which is prone to developer error), we enforce security at the Database Layer. This provides a mathematical guarantee that one tenant cannot access another's data.

• Row-Level Security (RLS): Every database query is intercepted by the Postgres Kernel. It is physically impossible for employees of one company to query another company's data.
• Tenant Context: Application logic runs within a strictly scoped Tenant Context that isolates configuration, API keys, and logs.

2. Authentication & Access Control

We utilize Supabase Auth (built on GoTrue), a battle-tested identity provider used by Fortune 500 companies.

• Role-Based Access Control (RBAC): Granular permissions allow you to define roles (Owner, Admin, Member). You decide who sees what.
• Multi-Factor Authentication (MFA): We support Time-based One-Time Passwords (TOTP) via Google Authenticator or SMS to prevent credential theft.
• Single Sign-On (SSO): SAML 2.0 and OIDC support for integration with corporate identity providers (Okta, Azure AD, Google Workspace).

3. Data Encryption

Data is protected at all stages of its lifecycle.

• Encryption in Transit: All data transmission occurs over TLS 1.2/1.3 encrypted connections.
• Encryption at Rest: All data stored on disk is encrypted using AES-256.
• Secrets: API keys and tokens are stored in dedicated tables with application-level encryption or separate Vault storage.

4. AI Security & Safety

Our AI engines are designed with strict guardrails to protect brand reputation and customer privacy.

• PII Masking: Sensitive Personally Identifiable Information is processed ephemerally and handled compliantly.
• System Guardrails: The AI operates under a strict "System Prompt" that forbids discussion of sensitive topics and enforces professional conduct.

5. Compliance Readiness

Our infrastructure is built to support your legal and compliance teams.

• SOC 2 Type II: Our infrastructure provider (Supabase/AWS) is SOC 2 Type II compliant.
• GDPR / CCPA: We fully support "Right to be Forgotten" deletion requests and Data Portability (exporting data in JSON/CSV formats).