Security
The controls that exist, listed without embellishment
This page describes what is implemented today. Where we do not have something, it says so.
We hold no security certification yet. You will not find a badge on this site implying otherwise.
Credentials
- API keys, bearer tokens, OAuth 2.0 refresh tokens, and HMAC secrets encrypted at rest.
- Used server-side only. The widget running on your page never receives them.
- Scoped per tool, so an assistant only holds what that tool needs.
Embedding
- A domain allowlist per deployment, so only your sites can load your assistant.
- Optional JWT verification, so the widget will only start a conversation for a signed-in user of yours.
- Rate limits per deployment to contain abuse and runaway spend.
Your content
- Documents stored in object storage and indexed as vectors, scoped to your organisation.
- Never used to train public models.
- Deleting a document removes it from the search index.
Answer integrity
- Structured values render from tool responses, mapped field by field. The model cannot author them.
- Prose answers show the source document.
- Retrieval is scoped to your knowledge bases, never the open internet.
Auditability
- Administrative actions are written to an audit log.
- Tool executions are recorded so a wrong answer can be traced to the call behind it.
- Outbound webhooks are HMAC signed so your systems can verify the sender.
Transport
- TLS in transit for the widget, the API, and every outbound tool call.
- Server-sent events for streaming, over the same encrypted channel.
Reporting a vulnerability
If you find something, tell us before you tell anyone else and we will work with you on a fix and a timeline. We will not threaten a researcher who reports in good faith. Use the contact form and mark the topic as security, and we will come back to you the same day.
For procurement questionnaires, send yours over rather than guessing what we can answer. We will complete what we can and flag the rest as not yet applicable instead of quietly ticking boxes.
Need something specific for review?
Tell us what your security team requires. We will say plainly what we have, what we can produce, and what does not exist yet.