Organizations stay apart

Every table that holds an organization's data is read through one layer that adds the organization to the query. A guard in the database session refuses any query on those tables that doesn't carry it, so a forgotten filter fails loudly instead of leaking.
Your membership is checked on every request, including each map tile and each download.
Files are stored under the organization's own prefix and reached only through links signed for a few minutes.

Secrets and passwords

Everything travels over HTTPS, and browsers are told to use nothing else (HSTS).
Model keys, connection credentials and webhook secrets are encrypted with AES-256-GCM, with a key of your organization's own. That key is itself encrypted with a master key kept outside the database. Each secret is bound to its organization and its record, so it can't be copied to another one. After saving, we only ever show the last few characters.
Passwords are hashed with Argon2id. Session tokens, email links and share links are stored only as hashes.
Two-step sign-in secrets are encrypted with AES-256-GCM too, and each code works once.

Accounts

Sign-in uses a session cookie the page's scripts can't read, plus a per-session ticket on every change, against cross-site requests.
Two-step sign-in with an authenticator app is available to everyone, with one-time recovery codes.
Sign-in, sign-up and email links are rate limited. After a few failed sign-ins, each further attempt needs a proof-of-work check that the browser solves in about a second, which makes guessing passwords expensive.
A failed sign-in says the same thing whether or not the account exists.
Changing your email, password or two-step settings, or adding a model key, asks for your password again unless you signed in in the last 15 minutes.

The application

A strict Content-Security-Policy: no inline scripts, no scripts from other sites except the payment provider's checkout, and the app can't be framed by other sites. The only other outside content is the basemap's tiles.
ZIP archives are checked before they're opened (size, file count, compression ratio, paths); servers that run virus scanning scan them too.
When we call an address you gave us (a webhook, an S3 endpoint), the call goes through a guard that refuses private and internal networks, follows no redirects and limits size and time.

The agent

The agent never writes SQL: its filters are checked against your fields and turned into parameterized queries.
Text inside your files is treated as data, never as instructions to the agent.
The agent never sends anything out of your workspace itself: sending a task to another system, posting to Slack or exporting to a bucket takes your click, and it makes share links only when you ask.
Per-organization limits on concurrent answers, and an optional daily limit on AI spend.

Backups and recovery

Every change to the database is archived within five minutes, and a full backup is taken daily, so we can restore it to any moment in between.
Uploaded files are copied to a separate backup every six hours; earlier versions are kept.
We test the backups with restore drills that rebuild the database from them and check every table.

Records

Sign-ins, membership changes, key and connection changes, credit grants and other sensitive changes are written to an audit log. Error reports, when we collect them, leave out request contents, cookies and credentials.

Reporting a problem

If you think you've found a vulnerability, email security@example.com with the steps to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll reply, keep you posted while we fix it, and credit you if you'd like.