Security Architecture & Practices

Every operational entity is strictly partitioned by workspace_id. PostgreSQL Row-Level Security (RLS) guarantees that tenant sessions can only view and mutate rows owned by their active workspace membership.

Connected third-party credentials (API keys, OAuth tokens, service accounts) are encrypted at rest using AES-256-GCM envelope encryption. Each secret is wrapped with a unique random Data Encryption Key (DEK) and protected by a hardened Master Key.

All outbound HTTP traffic (website scrapers, webhooks, CMS bridges) runs through a hardened validation proxy. Requests to loopback (127.0.0.1), private RFC1918 subnets, Carrier-Grade NAT, and cloud metadata (169.254.169.254) are rejected at the DNS pre-resolution phase and revalidated on every redirect hop.