The technical controls behind the platform.
The six pages under Security explain how and why the platform is built the way it is. This page is the factual reference — the specific mechanisms, in plain terms, for security and procurement review.
Authentication
- Role-Based Access Control (RBAC)
- Service-to-service authentication tokens
- Session authentication
- Principle of least privilege enforced at every access boundary
Internal microservices authenticate requests using service tokens, preventing unauthorized inter-service communication.
Related: RBAC & GovernanceEncryption
- Sensitive application secrets are encrypted before storage using Fernet authenticated encryption
- TLS for encrypted communication between clients and services
- Encrypted, token-authenticated communication between internal services
Fernet protects application secrets specifically — API keys, credentials, and tokens — not full-database encryption.
Related: Data IsolationData Isolation
- Logical tenant isolation between customer environments
- Project-level separation — no shared state by default
- Scoped access permissions tied to project and team boundaries
Monitoring
- Audit logging across the platform
- Workflow execution logs
- Pipeline run history
- AI decision traceability
Governance
- Human approval workflows for sensitive actions
- Explainable AI outputs
- Access governance across projects and teams
- Operational monitoring of running systems
This page documents platform-level controls and is updated as the platform evolves. It intentionally omits implementation details such as specific infrastructure versions, which do not affect the controls above. For contractual security and data-handling commitments, see the Data Processing Agreement and Service Level Agreement.
How each of these works, in depth
Reviewing this for procurement?
We're glad to walk your security or legal team through this directly, alongside the DPA and SLA.