Security Architecture & Practices

Every customer record carries a workspace_id, and every read and write is scoped to the workspace you are signed in to. PostgreSQL Row-Level Security (RLS) policies on those tables add a second layer, so a direct database session can only reach rows of workspaces it belongs to.

Connected third-party credentials (API keys, OAuth tokens, service accounts) are encrypted at rest using AES-256-GCM envelope encryption. Each secret is wrapped with a unique random Data Encryption Key (DEK) and protected by a hardened Master Key.

All outbound HTTP traffic (website scrapers, webhooks, CMS bridges) runs through a hardened validation proxy. Requests to loopback (127.0.0.1), private RFC1918 subnets, Carrier-Grade NAT, and cloud metadata (169.254.169.254) are rejected at the DNS pre-resolution phase and revalidated on every redirect hop.