You are handing an AI access to systems that matter. Here is exactly what
we do about that — stated plainly, with no claims we can't back.
Secrets
Connector credentials are encrypted at rest and reached only through a dedicated secret service.
A secret is never rendered back to a browser after it is saved — not to you, not to your admins, not to our support staff.
Raw credentials are never written to a log, an error message, or an audit snapshot. Redaction happens on the way into the audit trail, not on the way out.
Tenant isolation
Every record belongs to an organization, and every query that reaches one filters on it explicitly.
Authorization is enforced in the service layer, not only in controllers or hidden UI.
Connectors can be private to one person even inside a shared organization, so an admin cannot open, test, or use another member’s own account.
Access control
Four organization roles — owner, admin, builder, viewer — with meaningfully different capabilities.
Platform staff are separate from customer accounts. Support cannot read your secrets, and acting on your behalf requires explicit, audited elevation.
Sessions are short-lived, and a password reset logs out every other device immediately.
Safe by default
New connectors are read-only until someone deliberately enables writes.
High-risk write actions require a human approval that is recorded with requester, approver, timestamp, and target.
Bulk action sizes are capped, and you can mark resources as protected so no tool can act on them.
Auditability
Logins, credential events, connector tests, server activations, and every tool invocation are recorded.
Audit records are append-only at the application level — nothing in the product updates or deletes one.
Failures surface a correlation ID in the UI, so a screenshot is enough for support to find the exact request.
Transport and hosting
TLS everywhere, HSTS on portal domains, secure cookies, and strict CORS allow-lists.
Hosted on Microsoft Azure with managed database backups.
Deployments are repeatable through CI/CD — no hand-edited production servers.