Compliance & Safety

Security & Privacy

Learn how the platform ensures total data sovereignty and execution safety through a local-first, privacy-centric architecture.

Zero Data Leakage

Sensitive data never leaves your infrastructure. All processing happens on your own hardware.

Isolated Execution

Workflows run in isolated environments with sandboxed tool execution and distributed locks.

Secret Management

Credentials are stored exclusively in environment variables or a local encrypted vault.

Authentication & Authorization

JWT Authentication

All authenticated routes require a valid JWT bearer token. Tokens are signed with JWT_SECRET and verified on every request.

Password Hashing

User passwords are hashed using bcrypt with salt rounds of 10. Plain-text passwords are never stored.

API Key Security

API keys are generated with a secure random prefix and hashed using bcrypt before storage. The raw key is returned exactly once at creation. Keys are compared using bcrypt on each request.

Ownership Checks

All resource routes enforce ownership by comparing the resourceuserId to req.user._id. Requests for resources owned by other users return 403 Forbidden.

Rate Limiting

The platform applies multiple rate limiters to protect sensitive endpoints and prevent abuse.

Global Limiter

Applied to all /api routes. Default: 100 requests per 15 minutes.

Auth Limiter

Applied to registration and login. Default: 5 attempts per 15 minutes.

Expensive Limiter

Applied to AI generation, workflow runs, and uploads. Default: 10 requests per minute.

Webhook Limiter

Applied to public /webhook routes. Default: 20 requests per minute.

Dashboard Limiter

Applied to public /api/live-status routes. Default: 100 requests per minute.

Security Headers

Helmet middleware is enabled with crossOriginEmbedderPolicy and crossOriginResourcePolicy disabled to allow CORS for the frontend. All other default security headers are applied.

Execution Guardrails

Runtime Safety

• Timeout limits for every step execution
• Memory usage constraints for worker processes
• Sandboxed tool execution with UID/GID restrictions
• Distributed locks for safe parallel and join-node execution

Audit & Transparency

• Full execution logs for every workflow run
• Input/Output sanitization for all tool calls
• Trace IDs attached to every log entry
• Open-source codebase for community security auditing

Webhook & A2A Security

Webhook Secrets

Public webhooks authenticate via a secret query parameter or x-webhook-secret header. The secret is stored hashed and compared on each request.

A2A Authentication

A2A webhooks require the team's unique x-a2a-secret header. External agents must be pre-authorized in the team configuration.

Security Best Practices

1. Never commit .env files to git
2. Use strong, unique API keys for LLM providers
3. Restrict MongoDB access to localhost or your VPC
4. Regularly audit workflow logs for unusual activity
5. Enable replica set for MongoDB to prevent data loss
6. UseTOOL_SANDBOX_UID and TOOL_SANDBOX_GID to restrict tool process permissions