Security & Trust

All traffic is served over HTTPS (TLS 1.2+). OAuth tokens and other sensitive fields are encrypted at rest with Fernet (symmetric AES-128-CBC + HMAC-SHA256). The encryption key is rotated per deployment.

Every write is gated by a permission check against a 9-role hierarchy (root → super_admin → agency_admin → org_admin → brand_admin → brand_member → agency_member → creator → viewer). Brand-scoped writes require explicit grant; the engine refuses cross-tenant operations even when the caller has the role.

Every governance and tenant-modifying action is recorded to an append-only audit log with 11 governance columns (actor, role at time of action, tenant scope, before/after JSON, IP, user agent, request ID, etc.). A Postgres trigger rejects UPDATE/DELETE on the table; the application database role has REVOKE UPDATE/DELETE/TRUNCATE.

Governance actions that could orphan a tenant (delete owner, demote sole admin, revoke last grant) are blocked at the API layer with an explicit error code so the operator can choose a successor first.

Customer content is never used to train AI models. Our LLM sub-processors (Anthropic, OpenAI, Google Gemini) each contractually exclude API traffic from training corpora. BYO-key customers swap the sub-processor for their own; we do not see traffic that flows through a BYO key.

Transfer, lock, archive, and other high-blast-radius governance operations require a fresh password re-authentication (sudo mode) on top of the standard permission check. Sudo tokens expire in 15 minutes.

Every query that touches tenant-scoped tables is filtered by a centralized tenant_filter primitive at the service layer. There is no raw SQL that bypasses it. Job-status lookups, memory-vault reads, and credit-account reads are all enforced.

Every new password is checked against the Have I Been Pwned breached-password corpus using the k-anonymity API. We never send the password itself — only a SHA-1 hash prefix. Breached passwords are rejected.