Security

Your AI provider key

When you save your AI provider API key in your dashboard, it's encrypted with AES-256-GCM before it touches the database — the database never holds a plaintext key. It's decrypted only in server memory, at the moment a request needs to call your AI provider, and discarded immediately after. The key is never returned to the dashboard or shown again after you enter it — not even to you.

Account authentication

Passwords are hashed with bcrypt — never stored in plain text. Sessions use short-lived signed JWTs (30 minutes for client dashboards, 8 hours for admin sessions), refreshed automatically using a separately stored, individually revocable refresh token (valid 30 days). Both dashboard and admin logins lock an account for 15 minutes after 5 failed attempts. Admin accounts additionally support TOTP-based two-factor authentication.

Request-level protections

• Security headers (via Helmet) including a Content Security Policy, HSTS, and clickjacking protection on every response.
• HTTP parameter pollution protection on all request parsing.
• Rate limiting on every endpoint — 100 requests/minute per IP on widget routes, tighter limits (5 attempts/15 minutes) on login, and 3/hour plus 10/day on the public demo pages.
• Uploaded documents are capped at 10MB and processed without being retained on disk after the response is returned.

What we don't claim

We haven't undergone a third-party penetration test or formal audit, and we don't hold a compliance certification like SOC 2. If that's a hard requirement for your business, write to us before signing up and we'll tell you honestly whether we're a fit.

Reporting an issue

If you find a security issue, write to us through the contact page and we'll respond as a priority.