How the platform secures APIs, credentials, and tenant data.
1. API SECURITY. All API access is authenticated and metered; production access requires a verified account.
2. CREDENTIAL STORAGE. API secrets are stored hashed; full secrets are shown once at creation and cannot be retrieved later.
3. ENCRYPTION. Data is encrypted in transit (TLS). Sensitive fields at rest are encrypted per our infrastructure standards.
4. ACCESS CONTROLS. Least-privilege access, role-based permissions, and owner-gated production credentials.
5. AUTHENTICATION. Developer accounts authenticate via the developer guard; production credential minting requires email verification.
6. AUDIT LOGGING. Security-relevant actions, including legal-document acceptance, are recorded with actor, IP, user agent, and timestamp.
7. INFRASTRUCTURE SECURITY. Hosted on hardened infrastructure with network isolation and monitored access.
8. INCIDENT RESPONSE. We investigate suspected incidents and notify affected developers where required by law or contract.
9. BACKUPS. Backups are retained for a limited window; deleted data may persist in backups during that window.
10. TENANT ISOLATION. Developer and customer data are logically isolated; one tenant cannot access another's data.