Security and compliance
What we do with your data, where it goes, and how to report a vulnerability.
The answers a security review asks for, in one place.
Reporting a vulnerability
Our disclosure policy lives at
/.well-known/security.txt. Report
anything you find; we acknowledge within two business days and keep you informed until it closes. We
do not pursue researchers acting in good faith under that policy.
Credentials and revocation
Agent access tokens live one hour. Refresh tokens rotate on every use, and a replayed refresh token revokes its whole chain rather than being merely rejected — a stolen token is therefore worth an hour at most, and using it destroys the connection it came from.
Any connection can be revoked, and revocation cascades to every token derived from it.
Isolation
A connection carries exactly one project. Nothing in a request can change it. Capabilities resolve permissions on every call from the membership in the database — not from a claim frozen in a token — so a role change takes effect on the next request rather than at the next login.
Data and models
Parts of the product send content to large language models. What we commit to:
- your data is not used to train any model;
- retention is bounded and encrypted at rest;
- transfers outside the European Union are declared, with their legal basis, in the sub-processor list.
This page is being completed alongside the API terms and the sub-processor list. Where a commitment is not yet published here, it is because it is being verified against the underlying contracts rather than asserted — a public commitment we cannot honour would be worse than silence.
What we do not claim
We hold no SOC 2 and no ISO 27001 certification today. Saying so plainly is more useful to your review than a page that stays quiet about it. What we can show is the controls above, and how they are enforced in code.