Security

Security is not an optional feature: it is integrated at every stage of the design, development and operation of the service. This page transparently documents our technical choices and deliberately refrains from any unverifiable claim.

We follow the recommendations of the ANSSI, the best practices of the OWASP, and we progressively align our processes with recognised frameworks (SOC 2, ISO 27001) without claiming certification to date.

In transit

• All communications use TLS 1.2 or 1.3 (no unencrypted HTTP connection accepted);
• Strict-Transport-Security (HSTS) header with a one-year duration, forcing the browser to use HTTPS only;
• TLS certificates managed via Cloudflare with automatic renewal.

At rest

• User passwords are hashed with bcrypt (unique-salt algorithm, resistant to brute force) and never stored in clear text;
• OAuth credentials of MCP connectors (Slack, Google Drive, etc.) are encrypted at the application level before being inserted into the database;
• Disk volumes are hosted on Contabo infrastructure, covered by the provider's physical and logical protection measures.

• Passwords hashed via bcrypt with timing-attack mitigation (constant response time for existing and non-existing accounts);
• Sessions based on signed JWT tokens: access token with a 12-hour lifetime; refresh token with a 7-day lifetime; password reset token with a 15-minute lifetime;
• Security stamp: an internal session identifier invalidates all issued tokens immediately upon password change;
• Session cookies marked HttpOnly, Secure and SameSite;
• CSRF protection via the Double Submit Cookie Pattern on all cookie-authenticated operations.

• HTTP security headers configured in production: strict Content-Security-Policy (no unsafe-inline or unsafe-eval), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a Permissions-Policy disabling sensitive APIs (camera, microphone, geolocation);
• SQL injection: impossible by construction thanks to a query builder that systematically parameterises all queries;
• Cross-Site Scripting (XSS): native escaping of the frontend rendering, sanitisation of Markdown content before rendering, restrictive CSP;
• Rate limiting on sensitive public endpoints (login, registration, search) per user, organisation and IP address;
• Strict server-side validation of user inputs via OpenAPI 3 specifications (typed generated contracts, automatic rejection of non-conforming payloads);
• Dependencies: continuous static analysis, automated security checks in the CI pipeline.

• Daily full backups of the server environment automatically performed by Contabo's backup service;
• Backups stored on our host's infrastructure in the European Union;
• Restoration procedure periodically tested on a pre-production environment.

• Application metrics collected to detect operational anomalies (latency, errors, quotas);
• LLM tracing for observability of calls to AI models, detecting cost or latency drift;
• Audit log: every sensitive action (login, role change, invitation, deletion, tool trigger) is recorded with timestamp, user and organisation identifiers. Tool parameters are projected in a sanitised way to exclude personal data;
• Automated alerts on critical security events (repeated authentication failures, quota overruns, server errors).

The exhaustive list of our subprocessors (hosting, AI model, payment and distribution providers) and the associated contractual guarantees (Standard Contractual Clauses, DPA) is published in our Privacy Policy.

Data breach notification

In accordance with Article 33 of the GDPR, in the event of a personal data breach likely to create a risk to the rights and freedoms of the data subjects:

• Notification to the CNIL within a maximum of 72 hours of becoming aware of the incident;
• Individual information of affected users as soon as possible when the risk is high;
• Transparent public communication on this page in the event of a significant incident.

We publicly communicate ongoing and upcoming security initiatives, for transparency and to reflect the continuous evolution of the service.

• In progress — Refresh token rotation: implementation of refresh token rotation with reuse detection and automatic revocation of the chain in case of anomaly;
• Planned — Application-level encryption of conversations in the database: extension of the AES-256-GCM encryption already applied to MCP credentials to the content of chat sessions with AI Agents;
• Goal — Multi-factor authentication (TOTP / passkeys): introduction of an optional then mandatory second authentication factor for administrator roles;
• Goal — External audit and penetration testing: security audit by an independent provider before the extended commercial phase;
• Goal — Progressive alignment on SOC 2 and/or ISO 27001: structuring of internal policies and procedures with a view to future certification, driven by demand from early enterprise customers.

Associated documents