Security

Security is the product.

The trust architecture that unblocks procurement - written for your IT and finance reviewers. Every statement on this page is auditable in the product.

Security architecture

Where data lives, moves, and gets processed

At rest · AES-256 In transit · TLS In memory only

Users

Ops · Partner · Member

Web tier

Next.js portal + API

  • Session auth, server-side authz
  • Signed impersonation tokens
  • No secrets in the browser

Data at rest · managed database

Postgres

RLS on every table · tenant scoping · AES-256 at rest

Storage

PDFs, statements, browser frames · signed expiring URLs

Credentials vault

AES-256-GCM envelopes · key IDs · rotation · tamper detection

Queue · Redis + BullMQ

Transactional outbox dispatch · transient job payloads · no secrets

Processing · isolated worker

  • Credentials decrypted in memory only, per attempt - never persisted or logged
  • Executes the pinned plan hash; effect policies enforced in code
  • Writes evidence back: steps, immutable attempts, screenshots

Egress control

Pinned host allowlist · TLS required · same-origin redirects · DNS re-resolution · private networks & metadata endpoints blocked

Bexio · Zevvy · SolarManager · Google · PayPal · AI extraction · Email

Security model

Defense in depth - five enforced layers

Identity & tenancy

Organization memberships and customer access grants; row-level security scopes every table to the tenant.

Credential encryption

AES-256-GCM envelopes with key IDs, tamper detection, rotation. Secrets never in configs, logs, outputs, or screenshots.

Authorization

Server-side checks on every API and re-validation in the worker before each step - database, API, and runtime all enforce scope.

Runtime egress control

Outbound requests bounded: pinned hosts, TLS, same-origin redirects, DNS re-checks, private networks and metadata endpoints blocked.

Audit & impersonation

Every sensitive action is an audit event. Support impersonation is read-only, 15-minute signed, fully logged.

Provenance

Nothing mutates history - the pinning chain

Pinning Chain
Workflow The reusable recipe
publish
Published Version Immutable · sha256 plan hash
deploy
Deployment Revision Freezes version, settings, connections
run
Run + Attempts Pinned · immutable evidence

Editing never rewrites

Changing a workflow creates a new draft and version. In-flight and historical runs keep executing exactly what they pinned.

Rotation never breaks

Credentials float to the current secret; the contract stays pinned. Rotating a password strands nothing.

Evidence is audit-grade

Approvals record a hash of the exact data reviewed. Failed attempts, retries, and reruns are all preserved - never overwritten.

For customer IT

The one-pager that unblocks procurement

Data residency

  • Primary store: managed Postgres and object storage in a major cloud
  • Region pinned per deployment - EU region available for Swiss / EU clients
  • Web and worker tiers run on managed cloud platforms; region details confirmed in the DPA

Encryption

  • TLS 1.2+ for all traffic in transit
  • AES-256 at rest (managed by the database platform)
  • AES-256-GCM envelope encryption for provider credentials - key IDs, rotation, tamper detection
  • Files served via signed, expiring URLs; secrets never in logs, outputs, or screenshots

Subprocessors

  • Core: managed web hosting, cloud database and storage, isolated worker runtime, email delivery, AI document extraction - each named in the DPA
  • Customer-directed only when enabled: Bexio, Zevvy, SolarManager, Google Workspace, PayPal
  • List maintained with change notice

DPA & compliance

  • DPA available; GDPR and Swiss revFADP aligned
  • Customer data used only to deliver the service - never for training or benchmarking
  • Breach notification without undue delay; data return / deletion on exit

Need it as a standalone PDF for an IT or procurement review? Request the one-pager

Safety by default

Built into the flow, not bolted on

Paused by default

Every new deployment starts paused. Nothing runs live until you activate it.

Zero-write test runs

Reads are real, writes are previews. Pilot a workflow without risking anything.

Approval gates

Humans approve before anything with money attached moves. Approvals record a hash of the exact data reviewed.

Immutable evidence

Every run pins its exact version. Failed attempts, retries, and reruns are preserved - never overwritten.

See the evidence live Read the architecture