Security

Platform Security

Multi-Tenant Data Isolation

Every customer operates in a fully isolated tenant. Data never crosses tenant boundaries — enforced by construction at the database, query, and tool-handler layers, not by optional filters a developer could forget to apply.

Role-Based Access Control

Granular RBAC with organization-level scoping. Users see only the data and modules their role permits. Permissions are enforced at every API endpoint.

Audit Trail

Changes are logged — who changed what, and when. The audit log is SHA-256 hash-chained so tampering is detectable, and customers can verify its integrity.

Two-Step Sign-In

Every user can protect their account with two-step sign-in using an authenticator app.

Encryption

Data is encrypted in transit with TLS and at rest on encrypted storage.

AI Governance

Every AI agent action is logged and reviewable, and changes preview before they are applied.

Compliance & Security Features

Security & Audit Controls

Access enforcement at every API boundary, cryptographic integrity checks, and tenant-level confidentiality. Changes are logged to a tamper-evident, hash-chain-protected audit trail; customers can verify integrity through our chain-verification API.

Healthcare & HIPAA Safeguards

For healthcare organizations and business associates: encrypted PHI fields, comprehensive PHI audit logging, role-based access control, and multi-factor authentication. A Business Associate Agreement with our hosting provider is signed. Customer BAAs are available on request — use the form below and choose the Legal / DPA / BAA topic.

Data Protection & GDPR

For customers with EEA, UK, or Swiss personal data, our standard Data Processing Addendum (DPA) provides Standard Contractual Clauses (Module 2 — controller-to-processor, EU 2021/914) to govern cross-border transfers.

Questions about security?

We're happy to discuss our security practices in detail, provide additional documentation, or walk through our architecture with your security team. To report a vulnerability, request a DPA or BAA, or ask a security or compliance question, send us a message below.