SECURITY IS NOT A FEATURE. IT'S THE FLOOR.

SYSTEM STATUS

Encryption

• —TLS 1.3 for all data in transit
• —AES-256 encryption at rest for all databases
• —Snapshot content encrypted with per-workspace keys
• —End-to-end encryption for API key storage (hashed with bcrypt)

Access Control

• —Role-based access: Owner, Admin, Member, Viewer
• —Multi-factor authentication required for all staff
• —Hardware security keys required for production access
• —Principle of least privilege for all infrastructure roles

Infrastructure

• —Hosted on AWS in us-east-1 and eu-west-1
• —No single point of failure — multi-AZ across all services
• —WAF + DDoS protection via AWS Shield
• —Automated vulnerability scanning on every deploy

Application

• —OWASP Top 10 addressed in code review checklist
• —Dependency scanning via Dependabot + Snyk
• —Automated SAST on every pull request
• —Quarterly third-party penetration testing

Data isolation

• —Strict workspace isolation — no cross-tenant data access
• —Row-level security enforced in PostgreSQL
• —Scrape jobs run in isolated containers per workspace
• —AI enrichment data scoped and purged after processing

Monitoring & response

• —24/7 infrastructure monitoring and alerting
• —Security incident response SLA: 1h for critical, 8h for high
• —Immutable audit logs retained for 90 days
• —Automated anomaly detection on authentication events