Legal / Security controls
Technical and organisational measures
The baseline controls used to protect Signal OS customer data. The final schedule is incorporated into an executed DPA.
Governance and responsibility
Security and privacy responsibilities are assigned to authorised operators. Material changes, incidents, access reviews and high-risk actions are recorded. Personnel and contractors with access to customer data are subject to confidentiality obligations and least-privilege expectations.
Identity and access control
Authenticated application access uses named user identities, protected sessions and role-based permissions. Workspace operations are tenant-scoped in PostgreSQL. Platform administration is separately permissioned, and individual outbound communication and irreversible deletion require recorded human approval.
Tenant isolation and data handling
Tenant-owned records use workspace identifiers and database policies that fail closed when no trusted tenant or system context is present. External content, webhook payloads, model output and connector results are treated as untrusted, validated and reduced before structured persistence or rendering. Model requests contain bounded task context rather than provider credentials; provider data collection is denied at the request-routing layer unless a separately approved production configuration states otherwise.
Secrets and encryption
Provider, OAuth, webhook and model credentials remain server-side and are not returned to browsers. Sensitive one-time values are encrypted or retained only as one-way verifiers. Production transport uses TLS. The final schedule will identify verified storage-encryption and key-management controls for each production provider.
Change, vulnerability and supplier management
Application changes are reviewed and tested in proportion to risk. Dependency, configuration and security findings are tracked to resolution. Providers are assessed for their role, data access, processing location and contractual safeguards before production use.
Logging, monitoring and incident response
Meaningful automation, approval, billing, access and service-case actions persist to PostgreSQL and are visible through operational or activity history. Webhooks are signature-verified and deduplicated. Suspected incidents are triaged, contained, investigated and documented, with customer notification handled under the DPA and applicable law.
Availability, recovery and deletion
Operational work uses durable queues, idempotency keys and retry controls. Backup, restore and recovery procedures are tested before the retention promise is enabled. Workspace deletion is separately gated by an exact allowlisted manifest, legal-hold check, live entitlement recheck, tenant-safe transaction and permanent audit evidence.
Customer responsibilities
Customers control their users, connected systems, lawful data sources and outbound approvals. Customers should grant only necessary access, protect credentials, review generated outputs and avoid uploading credentials or unnecessary sensitive data.