How we protect your workspace

What we do today, described plainly. We will not claim certifications we do not hold.

Workspace isolation

Every agent, document, conversation and usage record carries its workspace, and every database query is limited to the workspace you are signed in to.

Accounts

Passwords of at least 12 characters, stored only as secure hashes. Lockout after repeated failures. Optional two-step sign-in with an authenticator app, required for platform staff.

Roles enforced on the server

Permissions are checked for every request, not just hidden in the menu. Refused attempts are logged.

Tamper-evident audit trail

Important actions are recorded in a log where each entry is linked to the one before it, so changes to history can be detected.

Prompt-injection defences

Knowledge is passed to the model as untrusted reference material below the platform rules. Agents cannot take actions today, and future actions will need human approval.

Aftaris, run by Aftermath

Agent messages go to Aftaris AI over an encrypted connection with a project key that never reaches your browser. Content is never sent to third-party AI companies.

Also in place

HTTPS everywhere, strict security headers and a content security policy that blocks third-party scripts.
Protection against cross-site request forgery on every form.
Rate limits on sign-in, registration, contact and test messages.
Secrets and configuration stored outside the public web folder.
No analytics, advertising or tracking cookies.

Report a security issue

If you think you have found a vulnerability, please tell us through the contact form and do not access other people’s data. We will reply and keep you updated.