Security

Tenant isolation

Every tenant table is protected by Postgres row-level security keyed to organization membership — one policy layer enforced by the database itself, not just application code.
Agent knowledge, transcripts, outputs, and usage records are scoped to your organization and unreadable by any other tenant.

Secrets handling

Connection credentials (Slack/Discord webhooks, GitHub/Notion tokens…) live in a table with no client-readable access path — only our server-side service role can read them, and our APIs never return a stored secret.
Connections are verified with a live API call before saving, and re-checked on every delivery.
Platform secrets are environment-scoped and never shipped to the browser.

Architecture & data flow

The application runs on Vercel; all organization data lives in Supabase Postgres (AWS us-east-1), under the per-tenant row-level security described above.
When an agent needs live data from a tool you’ve connected — a Shopify order, a Stripe charge, a Calendly booking — the platform resolves that connection’s stored secret server-side, calls the provider, and strips any credential-shaped value out of the result before it’s added to the model’s context. The model sees the looked-up answer; it never sees the secret that fetched it.

Abuse & egress protection

Customer-supplied URLs (site scans, custom webhooks) pass an egress guard that blocks private networks, loopback, link-local, and cloud-metadata addresses — checked when saved and on every send.
Public widget endpoints use unguessable per-agent keys, are disabled by default, and are rate-limited per agent.
Org-level burst limits and monthly budgets cap every model call path.

Billing integrity

Stripe webhooks are signature-verified and idempotent — replayed events can’t double-apply.
Card data never touches our servers.

Auditability

Widget conversations are stored as transcripts your team can review.
Every escalation, draft, and captured lead lands in a review queue with status history.
Every model call is metered with tokens, model, and timestamp.

Infrastructure

Hosted on Vercel (application) and Supabase on AWS us-east-1 (database, auth, vector search).
TLS for all traffic in transit; encryption at rest for stored data; daily automated backups.
Model calls go to OpenAI’s API; inputs and outputs are not used to train OpenAI’s models, per OpenAI’s API data-usage policy.
Health monitoring endpoints and structured failure handling — a failing dependency degrades gracefully rather than exposing errors to your customers.

AI governance

Model provider: OpenAI, for both agent replies and the text embeddings that power knowledge retrieval. Inputs and outputs sent through the OpenAI API are not used to train OpenAI’s models, per OpenAI’s API data-usage policy.
Approval before publish: every customer-facing draft an agent produces — a review reply, a social post, an escalation note, a captured lead’s follow-up — is written to a review queue in a pending state and requires a human decision before it’s sent or published. Live replies inside the embeddable chat widget are real-time conversational answers, not queued drafts — that immediacy is the product; the gate applies to what an agent produces for you to send or publish beyond the conversation itself.
Evidence, not assertion: where an agent states a number (a price, a date, a percentage) or verifies a claim against your live site, the system checks that figure or verdict against the retrieved source text in code — not just a prompt instruction — before it can reach a draft.
Bring-your-own-key access and additional model providers remain on our roadmap, below.

Data retention & export

Every organization sets its own retention window for conversation transcripts — a fixed number of days, or indefinite — from Settings → Data & privacy. The same page lets any workspace owner export a complete, machine-readable copy of the organization’s data (profile, team, agents, outputs, conversations, and usage) as a JSON file on demand, or request deletion of transcripts alone or the entire organization — no ticket required. Every export and deletion request is written to the audit log.

On the roadmap

Audit-log export for enterprise plans (the log itself is live today — immutable, append-only, with an in-app viewer).
Bring-your-own-key model access.
SOC 2 program as we grow — the controls above are designed with that path in mind.

Responsible disclosure

Found a vulnerability? Email security@hiredhands.dev. We respond within 48 hours, and we won’t pursue action against good-faith research that respects user data and service availability.