Trust & Security
Built to be trusted with the work that matters.
We design and operate to SOC 2-aligned and HIPAA-aware practices. Below is not a badge — it’s the concrete set of controls we actually run.
Secrets never touch the browser
Every credential — API keys, database service accounts, email passwords — lives only in Google Secret Manager, read server-side at runtime. None is ever shipped in a client bundle, committed to a repo, placed in a prompt, or stored in a memory.
- Server-side-only access to third-party APIs
- No secrets in the client, the repo, or logs
- Per-integration keys, individually revocable
AI that waits for a human
Our supervised agents draft work; a person approves before anything reaches a client, a codebase, or an outside system. Drafting is free; sending is a deliberate click. Autonomous actions are opt-in, capped, and always overridable by a kill switch.
- Every outbound action is human-gated by default
- Fail-closed daily spend ceilings on model usage
- One-click kill switch pauses the whole agent fleet
- Every action written to an immutable audit log
Access checked on every request
Authorization is enforced at the database, not just hidden in the UI. Firestore security rules re-check the caller's identity and role on every read and write, so a tab a user can't see is also a query the server rejects.
- Role-based access (super-admin, admin, manager, staff, client)
- Rules re-verified server-side on every operation
- Deactivating a user revokes access and live sessions
- Delegated capabilities are field-scoped and least-privilege
Sensitive data, handled carefully
In our healthcare products, protected health information is encrypted at the field level and kept out of persistent client storage. Data lives in Google Cloud (Firestore, Cloud Storage) with the platform's encryption at rest and in transit.
- Field-level PHI encryption in clinical products
- Encryption in transit (TLS) and at rest (Google-managed)
- Least-data-necessary in cross-app integrations
Recoverable by design
Client data is protected against loss and mistakes: point-in-time recovery, scheduled daily backups with retention, and database delete-protection. We have run and verified a restore drill, not just enabled the setting.
- Point-in-time recovery (7-day window)
- Daily backups with retention
- Database delete-protection on
- Restore drill performed and verified
Hardened at the edge
The public surfaces are defended in depth: HTTPS-only with HSTS, per-identity rate limiting on abusable routes, reCAPTCHA Enterprise / App Check attestation, honeypots on public forms, and a Content-Security-Policy currently in monitored rollout.
- HSTS + secure headers; CSP in monitored rollout
- Rate limiting on public and authenticated routes
- App Check / reCAPTCHA Enterprise attestation
- Dependency-advisory review with a CI audit gate
Need the details for a security review?
For enterprise engagements we’ll walk your team through our architecture, data handling, and controls, and complete a security questionnaire or sign a DPA/BAA where the engagement calls for one.
Talk to usA note on honesty: “SOC 2-aligned” and “HIPAA-aware” describe how we design and operate — not a completed third-party audit or certification. If your engagement requires formal attestation, tell us and we’ll scope it.