Technical and organisational measures

Access and tenant boundaries

Authenticated users have named accounts, protected sessions and workspace roles. Application permissions and PostgreSQL tenant policies restrict workspace-owned records to the authorised context. Platform administration is separately permissioned. Customers manage their users and should remove access promptly when responsibilities change.

Transport and credential protection

Public production traffic uses HTTPS. Provider and integration credentials remain on the server; sensitive stored credentials use application encryption. Passwords are stored using a password-hashing scheme. One-time account-verification values are protected through encrypted delivery records or one-way verification values as appropriate.

These controls do not imply that every field is encrypted with a separate customer key. Provider storage encryption, physical security and regional arrangements depend on the service being used; request the current evidence relevant to your deployment rather than assuming a certification or location.

Validation, isolation and human control

External pages, connector responses, messages and AI output are treated as untrusted input. The application bounds and validates relevant content before using it in structured operations. Workspace permissions and approval controls apply to actions such as individual outbound communication and destructive changes.

Intelligence processing uses context needed for the task. A separately restricted categorisation route excludes personal and customer-confidential information. Generated output still requires review; validation is not a guarantee that an external source or model is correct.

Operational records and delivery integrity

Billing, approvals, automation and important account actions are persisted in operational records so authorised users and operators can investigate outcomes. Relevant provider webhooks are signature-checked and duplicate events are handled with idempotency controls. Sensitive provider credentials are not intended for customer-visible logs.

Changes, incidents and suppliers

Application changes use version control and relevant automated checks. Security or configuration findings are investigated and corrected according to their impact. Provider roles, access and handling terms are considered when selecting an integration.

Suspected incidents are assessed, contained and investigated. Customer notifications concerning personal-data breaches follow the applicable agreement and law; the data processing addendum explains assistance and notification responsibilities.

Data processing addendumReport a security issue

Recovery and deletion

Durable records and retry controls support recovery from interrupted work. Backup and restore procedures form part of operational release review. Ask us for the current backup, recovery and restore-test evidence relevant to your workspace; any specific recovery-time or recovery-point commitment must be agreed in writing.

Workspace deletion requires scope, authority, entitlement and legal-hold checks and preserves necessary audit evidence. Requests are reviewed before execution, including their effect on backups and retained legal records. We can explain the available export and deletion process as part of a customer’s security review.

Shared responsibilities

Customers are responsible for appropriate role assignments, authorised data sources, connected-service permissions and review of outbound actions. Keep local devices and connected accounts secure and tell us promptly about suspected compromise. We can discuss additional security requirements before an order is agreed.