Security you can explain to procurement
Controls aligned with SOC 2 trust principles — confidentiality, integrity, and availability for workspace data.
Identity & access
- OWeb OneID via Supabase Auth — no duplicate password silo
- Workspace-scoped roles and membership APIs
- Session middleware on studio and agent routes
Data isolation
- Satellite table prefix and RLS on One OS
- Generation records scoped to workspace
- BYOK keys not persisted server-side by default
Operations
- TLS in transit; encryption at rest via Supabase/Vercel
- Audit-friendly logging on auth and redeem flows
- Subprocessor list in Privacy Policy