01
Sandboxed parsers
Every AI-generated parser runs in a hardened Docker container with no network, read-only FS, locked-down syscalls, and a 30-second soft timeout. The parser process can't reach your data store, your secrets, or the host.
Home/Security
Defense in depth, not by adjective.
Six controls that ship in every plan. Diligence-ready under NDA.
02
Multi-tenant isolation
Every query carries an org_id and is filtered by a SQLAlchemy event hook before it leaves the app. Cross-tenant reads are impossible by construction, not by convention.
03
Argon2id everywhere
Passwords and API keys are hashed with Argon2id (m=64MB, t=3, p=4). Plaintext keys are visible exactly once, in the create-key dialog. After that we keep a SHA-256 lookup hash and the Argon2id verifier — never the original.
04
Encrypted in transit and at rest
TLS for all traffic to the API and dashboard. Storage is encrypted at rest by our providers (Neon for Postgres, Cloudflare R2 for files).
05
Audit log and hash-chained processing records
Account actions such as sign-in, key creation, member invites and settings changes are recorded in an audit log. Data processing events (uploads, transformations, erasures) are hash-chained with HMAC-SHA256 under a per-organisation key, and the chain can be verified on request.
06
Backups + restore
R2 versioning + 30-day lifecycle on every input/output bucket. Daily Postgres pg_dump → R2 with restore drill documented in docs/runbooks/backups-and-restore.md.
Want the full diligence pack?
Security documentation, sub-processor change feed, DPA, EU AI Act register. We send under NDA — usually same-day.