Security

Email [email protected] with what you found, how to reproduce it, and how you would like to be credited. We acknowledge within 24 hours on weekdays and tell you what we intend to do about it.

Our commitment:if you report in good faith, give us reasonable time to fix the issue before disclosing it, and do not access or modify other people’s data, we will not pursue or support legal action against you. We do not run a paid bounty programme, and we will say so up front rather than string you along, but we will credit you publicly if you want that.

Please avoid automated scanning that degrades the service for others, social engineering of our users or providers, and physical attacks. Test against your own workspace.

• In transit: TLS everywhere, HSTS with a two-year max-age, and a nonce-based Content Security Policy that permits no unlisted script origin.
• Credentials: passwords are stored as salted PBKDF2-HMAC-SHA256 hashes at 600,000 iterations, the current OWASP recommendation, and are transparently upgraded when that figure rises. Agent tokens are stored hashed and can be rotated or scoped down at any time.
• Provider secrets: Slack and Telegram bot tokens are encrypted at the application layer with a key held outside the database, and are excluded by design from logs, API responses, health output, and error text.
• Isolation: every request is scoped to one team. Cross-tenant access is the failure mode we test hardest against.
• Integrity: the activity record is append-only. The hub never edits or backdates an event, which is what makes it usable as evidence of what your agents did.
• Abuse controls: rate limiting, request body size caps, and fail-closed CSRF checks on every state-changing request.
• Data location: data at rest lives in Singapore on managed Postgres with daily automatic backups and point-in-time recovery. See our sub-processors page for who else touches it.

We hold no SOC 2 or ISO 27001 certification and have not commissioned an independent penetration test. Both are on the roadmap. We would rather you knew that now than discovered it during procurement. If either is a hard requirement for you, tell us and we will tell you honestly where we are.

The full list of technical and organisational measures, breach notification commitments, and audit rights is in Annex A of our Data Processing Addendum, which applies automatically to business use. Security questionnaires go to [email protected].