Security & Trust

All traffic is served over HTTPS. OAuth access and refresh tokens and stored LLM provider credentials are encrypted at rest with Fernet (symmetric AES-128-CBC + HMAC-SHA256), decrypted only at the moment of use. Provider profile payloads returned by OAuth are retained unencrypted and are purged on account deletion.

Writes are gated by permission checks against a 9-role hierarchy (root → super_admin → agency_admin / org_admin → agency_member → brand_admin → brand_member → creator → viewer). Brand-scoped writes require an explicit grant; the engine refuses cross-tenant operations even when the caller holds the role. Endpoints that act only on the caller's own records are scoped by ownership rather than by the role engine.

Governance and tenant-modifying actions are recorded to an append-only audit log carrying the actor, their role at the time of the action, tenant scope, before/after JSON, IP, user agent and request ID. A Postgres trigger rejects UPDATE and DELETE on the table, so history cannot be rewritten after the fact.

Governance actions that could orphan a tenant (deleting the last owner, demoting a sole admin, downgrading the final owner-tier role) are blocked at the API layer with an explicit error code so the operator can choose a successor first.

Customer content is never used to train AI models. Our LLM sub-processors (Anthropic, OpenAI, Google Gemini) each contractually exclude API traffic from training corpora. With a BYO key, the request is billed to your own provider account under your own terms — but it is still composed and sent from our servers using your key, so treat it as processed by us, not as a private channel.

Transfer, lock, archive, and other high-blast-radius governance operations require a fresh password re-authentication (sudo mode) on top of the standard permission check. Sudo tickets are single-use, bound to the specific request they authorize, and expire within two hours.

Tenant-scoped reads and writes are filtered either by a centralized tenant_filter primitive or by an explicit brand-access guard at the endpoint. No raw SQL bypasses the ORM to reach tenant tables. Job-status lookups, memory-vault reads, and credit-account reads are all enforced.

Passwords set through registration, reset and change are checked against the Have I Been Pwned breached-password corpus using the k-anonymity API. We never send the password itself — only a SHA-1 hash prefix. Breached passwords are rejected.