Security
You are pointing a language model at software that runs your business. Here is exactly what stops it doing something you did not ask for.
The model is an untrusted planner
An LLM suggestion is a request, never an instruction. Nothing it says is taken on trust — not the tool name, not the arguments, not its claim about what it is doing. Every proposal is re-derived from the database before anything happens.
No raw execution path
There is no way for a model to run SQL, a shell command or an arbitrary URL. Actions exist only as registered tools with schemas.
Nothing identifying in the prompt
Tool specifications carry a name, a description and a schema. No connection ids, organization ids, hostnames or credentials.
Undeclared arguments are dropped
A model that smuggles an extra field into a closed schema gets it stripped before the connector sees it — and the trace records that it tried.
No borrowed authority
An agent acts on behalf of a person and cannot lend them permissions they do not have.
Failures go back to the model
A refused call is returned as an error result. A model told nothing invents an answer instead.
Bounded, always
A hard step ceiling applies regardless of configuration, so a model that proposes forever terminates rather than running up a bill.
These are tested adversarially. The suite drives the runtime with a provider that proposes exactly the call an attacker would want — a tool that does not exist, one the agent was never given, arguments edited after approval — and asserts the platform refuses it and that no data changed.
Tenant isolation
The organization is the tenant. Every tenant-owned table carries an organization id and a global scope that fails closed — with no tenant resolved, queries match nothing rather than everything. Cross-tenant writes are refused at the model layer, not just filtered at the query layer.
Credential encryption
Envelope encryption: each secret gets its own key, itself encrypted by a versioned master key, with the key version bound into the authenticated data. Rotation does not require re-encrypting every row. Administrators cannot read tenant credentials.
Outbound request protection
Every URL is validated on save and again on every request, including each redirect hop. Private ranges, loopback, link-local — including cloud metadata endpoints — CGNAT and IPv4-mapped IPv6 are refused. A host that resolves publicly today can resolve privately tomorrow, which is why it is re-checked every time.
Database safety
Queries are validated structurally: a single statement, an allow-listed leading keyword, no schema changes anywhere, and no UPDATE or DELETE without a WHERE. MySQL executable comments are refused outright rather than stripped, because the server executes what a naive parser reads as a comment.
Hash-chained audit
Every consequential action is recorded and linked to the one before it, so a removed or altered entry is detectable. Arguments are redacted and summarised, never stored raw.
Approvals bound to one call
An approval stores a fingerprint of the exact arguments shown to the reviewer, recomputed when the call actually runs. Approving “delete customer 100” cannot become “delete customer 1”.
Your data
Lapsing never deletes
If a payment fails and the grace period runs out, your workspace falls back to free-plan limits. Every agent, connection, execution and conversation stays exactly where it is. The same is true if you cancel.
Retention is yours to set
Executions, conversations and audit entries each have their own retention window, configurable per workspace.
Nothing is used to train anything
Your data is used to answer your requests. It is not used to train models.
What we do not claim
No compliance certification is claimed. Two-factor enrolment and SSO are on the roadmap, not shipped. An agent can still be asked to do something legitimate and unwise, which is why high-risk actions stop for a person rather than relying on the model's judgement.
If you find something, please tell us — see the security policy in the repository for how to report it.
Read the threat model in full.
The complete security documentation ships in the repository, written alongside the code it describes.