Security

Last updated 21 September 2026

How to report a vulnerability, and what the product actually implements during the unbilled pilot. This page is not a security addendum or certification.

Pilot terms — not a substitute for counsel-drafted enterprise legal

These pages apply to the unbilled pilot only. They are not a master services agreement, data processing agreement (DPA), or other negotiated enterprise contract, and they are not a substitute for one.

What the product actually does is described below and is tied to running code: Zero Data Retention is opt-in per tenant (not universal); readable chat has an enterprise retention window (default 365 days) and the delete job is opt-in for the deployment; WorkOS single sign-on runs only when an organization configures it; directory sync (SCIM) is not enabled; no payment processor handles customer data because the pilot is unbilled.

What counsel still owns, and must supply before any billed or “enterprise battle-ready” launch: the legal entity name and address; governing law and venue; limitation of liability; indemnity; approved privacy and security contacts; a DPA and Standard Contractual Clauses / UK addendum if transfers require them; CCPA/GDPR controller or processor roles; a subprocessor change process; customer incident-notification commitments; insurance statements; paid Terms that replace this pilot ToS; and trademark rules. None of those are invented here.

We do not hold SOC 2, ISO 27001, HIPAA, PCI-DSS, or any other certification.

Reporting a vulnerability

Email [email protected]. Please include enough detail to reproduce the issue.

During the pilot we aim to acknowledge vulnerability reports within three business days. That is an operational target, not a contractual incident-notification SLA. Customer breach-notification commitments must come from counsel.

Please do not run automated scanners against production, access or modify data belonging to another tenant, or degrade the service for other users while testing.

Security practices we actually implement

Passwords are stored as scrypt hashes with a per-user salt; they are never recoverable, including by us.

Sessions use signed, HTTP-only, SameSite=strict cookies, and every state-changing request requires a matching CSRF token.

Authorization is enforced server-side on every request. Tenant scope is derived from the session, never from a URL, header or request body.

API keys for programmatic access are stored only as SHA-256 hashes, verified in constant time, and can be scoped, expired and revoked.

Traffic is served over HTTPS. Credentials, cookies and authorization headers are redacted before anything is logged.

We do not hold SOC 2, ISO 27001, HIPAA, PCI-DSS, or any other certification, and we do not claim to.

Current limitations we disclose openly

The service runs as a single instance; a restart or deployment clears in-flight routing sessions and in-memory rate-limit counters.

We hold no third-party security certification (including SOC 2, ISO 27001, HIPAA, and PCI-DSS). Statements on this page describe implemented behaviour, not audited controls, and they are not a substitute for a negotiated security addendum.

Contact

Security: [email protected].