Security

Provider credentials are stored in a per-workspace isolated database. Each workspace has its own storage boundary; no workspace can read another workspace's credentials, and our routing layer only accesses credentials scoped to the workspace running the current session. Data is encrypted at rest using AES-256 by the underlying infrastructure.

Every connection between your client, our routing layer, and your upstream provider runs over TLS 1.2 or higher. Credentials never traverse an unencrypted network.

Credentials are readable only by:

• Our routing worker, at the moment it opens a session on your behalf.
• You, the workspace owner, via the dashboard.

Credentials are never:

• Returned in bulk list responses. The provider list endpoint returns hostnames and connection metadata only.
• Written to application logs. Our logging layer is audited and never records URLs containing query parameters or authentication header values.
• Exposed to support staff without an explicit, audited access request.
• Sent to any third-party analytics or observability service.

To copy or edit a stored credential, you use a dedicated reveal endpoint that returns the full value only for that single request, with response caching disabled to prevent browser or intermediary retention.

When you delete a provider from your workspace, its credentials are removed from storage immediately.

When you delete your workspace, all provider credentials for that workspace are removed within 30 days as part of the standard account purge cycle.

• Session cookies, page content, or any data captured from your provider during a session, unless you explicitly enable Profiles or Recording, which are documented separately.
• Copies of your credentials outside the primary per-workspace database. We do not maintain shadow copies for support, analytics, or backup purposes.

If you believe your credentials have been exposed or you spot a security issue on our platform, email [email protected] directly. We treat every report as a P0.