Security

Use Security to review the product controls, data protections, and access boundaries admins need before rollout.

Core controls

Data is encrypted at rest with AES-256 and protected in transit with TLS 1.3. Security controls are aligned with SOC 2 criteria, with formal certification in progress.

We use OAuth instead of asking for provider passwords. Access tokens are encrypted, and sensitive token material is kept separate from normal application data.

Access boundaries

Connected apps such as GitHub, GitLab, Slack, Jira, Linear, and Google Calendar keep their own user-level permissions. Provider access rules continue to control what connected data each user can access.

If a user cannot access a repository, issue, Slack channel, or calendar in the source app, it should not be exposed through the integration.

Work and agents

Initiatives, bugs, todos, comments, documents, and prompts can become context for coding agents. Agent Sessions separate trusted platform and worker policy from untrusted workspace content before a worker executes.

Review Security together with Permissions, Data Residency, and Compliance.