Security

Tenant isolation

Every request carries an authenticated organization, project, and environment. Authorization is enforced server-side on each route and object; the client never decides access.

Credential custody

API keys are hashed and shown once. Provider credentials are write-only, versioned, and decrypted only at dispatch. No secret reaches logs, URLs, analytics, or support bundles.

Encryption

Secrets at rest use envelope encryption under a platform key, each value bound to the record that owns it: stored provider credentials (per-tenant, per-credential context), telemetry export headers, webhook signing secrets and integration configs. Customer-supplied wrapping keys are available for stored provider credentials only; rotate or revoke them yourself. Transport security is whatever your deployment terminates TLS with — nothing is claimed here.

SDLC

Schema changes are migrations with checksum locks; the ledger's invariants are tested by trying to violate them. No signed-artifact pipeline, scanner or rollout automation is claimed.

Incident response

Incidents carry a named commander, per-component status is published under two-person approval, and customer-visible updates are auditable. No on-call coverage level is claimed.

Continuity

Per-endpoint circuit breakers on gateway-measured evidence; provider failure degrades to re-routing inside your constraints, not to an outage. No multi-region deployment or restore-test cadence is claimed.