00Security & trust
What protects the record. And what doesn’t exist yet.
Written for the person whose job is to find the gap. The gaps are on it.
01Isolation
How your data
is kept apart.
- Every query is scoped by the database, not by application code
- Row-level security is enabled on every customer table, and application queries filter by organization as well. A query that forgets its organization filter returns nothing rather than someone else's rows, because the policy is evaluated in Postgres and cannot be bypassed by a bug in a handler.
- The audit table has no update or delete path
- Database triggers refuse updates and deletes for every role, including Ovelin's own service role. Entries are sealed on write with HMAC-SHA256, chained to the previous record, and recomputed on read.
- Credentials are removed before anything is stored
- Incoming payloads are scanned for API keys, private keys, tokens, card numbers and personal identifiers, and those values are masked on the way in. An append-only table cannot un-write a secret afterwards, so it is never written.
- Keys are stored hashed and compared in constant time
- An API key is never held in a readable form, and it travels in an Authorization header rather than a URL, so it does not appear in access logs. Redirects are refused so a key is never replayed to another host.
02Open source
Read the code that
sits in your path.
The gateway that proxies your agents’ tool calls is open source with no runtime dependencies, so whoever has to approve it can read it in an afternoon. Asking a security team to trust a binary in the request path is a lot; asking them to read one file is not.
03Subprocessors
Who else touches it.
Every third party in the path, and what each one holds.
| Processor | Purpose | Data |
|---|---|---|
| Supabase | Postgres database and authentication | All customer data: audit records, agent inventory, accounts |
| Vercel | Application hosting and edge network | Requests in transit; no customer data stored at rest |
| Resend | Transactional email (invitations, password resets) | Recipient email addresses |
04Not yet
What we are not.
- We are not SOC 2 certified
- No audit has been completed and none is in progress. What exists instead is testable: the isolation properties above are covered by automated tests that attempt to cross an organization boundary and assert they fail. Ask and we will walk you through them.
- We are not ISO 27001 certified
- The product maps your obligations under ISO/IEC 42001 and other frameworks. That is a different thing from us holding a certification ourselves, and we do not.
- We do not offer a signed uptime SLA
- Service health is published and machine-readable. An SLA is available under an enterprise agreement; outside one, we do not claim a number we have no track record for.
05Disclosure
Reporting a vulnerability.
Report privately via the contact form rather than in a public issue. Expect a first response within three working days. We will not pursue anyone who reports in good faith and does not access data that is not theirs.
Data controller
The registered legal entity, its address, the storage region and the retention period are published here before general availability. Until then, ask and we will tell you in writing.