Security & Trust
How we protect your data, secure your AI Agents, and maintain workspace isolation.
Row Level Security (RLS)
We enforce strict Supabase Row Level Security. All client-side direct access is denied. Database access is mediated strictly through server-side queries utilizing secure service role API layers.
Secure Authentication
Policy--Bot integrates Clerk for user sessions and security. Dashboard consoles and backend admin APIs require secure, verified JWT validation before executing any commands or mutations.
SSRF & Ingestion Safeguards
URL ingestion tools check protocols and run hostname regex filters to block access to private subnets, local hostnames (SSRF mitigation), and restricted cloud metadata services.
Prompt & RAG Isolation
AI generations isolate user questions using custom XML tags inside LLM instructions. This prevents prompt injection attacks from overriding system behaviors or accessing unauthorized information.
Rate Limiting
We enforce strict rate limits per user for admin operations and per IP address for public AI Agent widgets, securing the platform from denial-of-service (DoS) and API abuse.
Immutable Audit Logging
Every sensitive action — including AI Agent deletions, URL ingestions, and unauthorized route access — triggers an immutable log entry with the caller's IP, resource references, and timestamp.
Have a security question?
We take security seriously. If you have any inquiries, vulnerability reports, or need compliance documentation, please contact our security team.