Security overview

At a glance

• Read-only by design

  We call usage, cost and directory endpoints only. We never see prompts, completions or files, and we can't change anything at your providers.

• Keys encrypted and bound

  Every key is encrypted with AES-256-GCM and bound to its workspace and provider, so a copied ciphertext is useless anywhere else.

• Rotation built in

  Key age is tracked against your policy. New keys are tested before they replace old ones, and every rotation is logged.

• Your identity provider

  People sign in with Microsoft Entra ID. Your MFA and Conditional Access apply, and only your tenant can join your workspace.

• Least privilege inside

  Admins change settings; Viewers can only look. Roles are enforced on the server for every page and action.

• Everything audited

  Connections, key rotations, budgets, mappings, members and knowledge access all land in an audit log.

Data we read and store

We keep the minimum needed to attribute spend: daily aggregates, not activity.

We read

Usage and cost reports, API key and project names, workspace names, directory groups and members (name, work email), and knowledge space names. The exact endpoints per connector are listed on Integrations & data access.

We store

Daily totals per key, model and day (tokens, requests, cost), key and project names, your teams and people, budgets, alerts and the audit log.

We never read

Prompts, completions, uploaded files, conversation history or model settings.

Deleting data

Disconnecting a provider deletes its synced usage. Revoking the key at the provider stops all access immediately. Workspaces are deleted on request.

Keys and encryption

At rest

AES-256-GCM with a fresh random IV per secret. Each ciphertext is bound to its workspace and provider as authenticated data, so it fails to decrypt if moved.

In the app

Keys are never sent back to the browser. Only the last four characters are shown. Provider error messages are scrubbed of key fragments before they're stored or displayed.

Validation

Keys are tested against the provider before they're saved. Regular (non-admin) keys are rejected without a network call.

Rotation

Choose a policy of 30 to 365 days. You get a heads-up 14 days before a key reaches its rotation age and an alert once it's overdue. Rotation tests the new key first; the old one keeps working until the new one is proven.

Failing keys

If a key is revoked or expires, the connector is marked Failing and an alert is raised on the next sync.

Master key

Our encryption key can be rotated with no downtime: the previous key is kept for reads while every secret is re-encrypted, then retired.

Sign-in and access

Protocol

OpenID Connect authorization code flow with PKCE, state and nonce. ID tokens are verified for signature, issuer, audience and expiry.

Who can join

Workspaces are linked to one Microsoft tenant. Users are identified by tenant and immutable object ID, never by email, and personal Microsoft accounts are rejected. Invites can only be claimed from the linked tenant.

Roles

Admin and Viewer. Every page and every action checks the role on the server. A workspace always keeps at least one Admin.

Sessions

Server-side sessions with a random token; only its SHA-256 hash is stored. Sessions end after 12 hours idle or 7 days at most. Cookies are HttpOnly, Secure and SameSite. Signing out, or being removed, revokes the session.

Brute force

Sign-in attempts are throttled per network address, stored only as keyed hashes.

Application security

Browser

A Content Security Policy that only loads our own scripts, styles and images; HSTS; framing blocked; no third-party scripts or trackers in the app. Fonts are self-hosted.

Requests

State-changing requests must come from our own origin. Server actions re-check the session and role every time.

Outbound calls

Connectors only call fixed vendor hosts over HTTPS, never follow redirects with credentials, and only paginate on the same host.

Inputs

Numbers are range-checked, text is length-limited, and links from third parties are restricted to http(s).

Fail closed

A production deployment refuses to start without its secrets configured; it never falls back to development defaults.

Testing

Every change runs unit tests and an automated attack suite (session handling, CSRF, cross-workspace access, injection, sign-in edge cases) in CI.

Knowledge for agents

When you connect Confluence or GitBook so agents can use company context, you stay in control.

Default

Every space starts disabled. Nothing is shared until an Admin turns a space on.

Scope

Each space can be limited to specific teams.

Kill switch

One organization-wide switch cuts every agent off from all company content instantly.

Record

Every change to knowledge access is in the audit log.

Operations and compliance

Hosting

We share the hosting provider, region and subprocessor list during procurement.

Compliance

We don't have a SOC 2 report yet. We'll complete your security questionnaire and walk your team through these controls.

Incident response

We can revoke every session at once and rotate our encryption key without downtime. We notify affected customers promptly.

Report a vulnerability

Email Justin.Tackling@boilerplate.fyi with details and steps to reproduce. We'll acknowledge within two business days and keep you updated. Please don't access data that isn't yours or disrupt the service while testing.