TRUST LAYER
Security posture
The platform is the authoritative identity, billing, and entitlement system — it is engineered accordingly. Below is the implemented control surface; the trust boundary between application and platform is defined in the integration contract.
Authentication
- ▸Passwords hashed with bcrypt (cost 12); never stored or logged in plaintext
- ▸Opaque session tokens — SHA-256 hashed at rest, httpOnly + SameSite cookies
- ▸Account lockout after repeated failures; uniform error responses
- ▸Full session revocation on password reset
Application authentication
- ▸Desktop app never stores your password — token grant only
- ▸Short-lived JWT access tokens (15 min) + rotating refresh tokens
- ▸Per-installation identity: inspect and revoke devices remotely
- ▸Revocation takes effect on the next authenticated call
Tenant isolation
- ▸Organization boundaries enforced in every scoped query
- ▸Membership + role verified server-side before any org data is returned
- ▸Usage, billing, and audit records partitioned by tenant
Billing integrity
- ▸Stripe Checkout/Portal — no card data touches our servers
- ▸Webhook signatures verified; events idempotent and replay-safe
- ▸Pricing resolved server-side from versioned rules — client amounts ignored
- ▸Integer micro-unit arithmetic; no floating-point money
API defenses
- ▸Per-IP and per-installation rate limits on sensitive routes
- ▸Zod-validated request schemas; malformed payloads rejected at the edge
- ▸Usage timestamps bounded; impossible measurements refused
- ▸Secrets live only in server environment — never in the client bundle
Data minimization
- ▸Usage records store measurements — not prompts or source code
- ▸Installation identity is a revocable token, not raw hardware IDs
- ▸Audit trail for administrative and security events
Found a vulnerability? Contact [email protected] — responsible disclosure is appreciated.