Security that is built in, not bolted on.
This page summarises the controls and states their limits honestly.
Read-only and allowlisted
Connectors open sources read-only, enforce a per-query column allowlist, a 2-second timeout and row caps. Credentials are encrypted with AES-GCM and deleted on revocation.
No buyer SQL
Requests compile from a published schema with bound parameters. Excluded fields cannot be reached through filters, sorting, aggregates or error messages.
Untrusted by default
Supplier rows are returned as data only. They cannot grant permissions, change mandates or disclosure, or trigger tools.
No passwords
Sign-in uses Google OpenID Connect with PKCE and verified ID tokens. Sessions live in httpOnly, Secure cookies with CSRF protection and expire after 12 hours.
Expiring, revocable tokens
AI connections use opaque bearer tokens that you can rotate or revoke from your dashboard. Your human identity stays separate from network pseudonyms.
What we do not claim
There has been no external cryptographic review yet, and no ratcheting forward secrecy. Hosted mode processes authorised plaintext. Report issues via /.well-known/security.txt.