Product security

This page is about the product’s own security posture: how one founder’s data is kept away from another’s, how credentials are handled, and — most importantly — the boundaries on what the agent is permitted to do without a person. For the company posture, see trust and security.

Tenant isolation

Isolation is a property of the resolvers, not of the interface. Every founder-scoped resolver takes the caller’s own claims as a required argument and has no unscoped form, so there is no default that can quietly read across tenants. This was a real defect once: an order lookup read the whole ledger with no owner filter and agreed with the scoped resolver only because both were empty. It is now structurally impossible to call it without a scope.

• Exclusivity is enforced by a unique database index — one product, one founder — rather than by application logic, because two code paths answering the same question is how the same bug reopened twice.
• Exclusivity applies to a look, not only to a purchase. Another founder’s claimed or held product is never rendered on your screen as available.
• Identifiers are scoped before they are looked up. An order id belonging to another tenant answers identically to one that does not exist, so the response cannot be used to enumerate other people’s records.
• People you invited are shown to you anonymised — the stage each reached, never an email address and never what they claimed.

Credentials and identity

• Sign-in is an emailed single-use link that sets a session cookie. There is no password, so there is no password to store or leak.
• The session cookie is HTTP-only and is never shared with an operator surface. Referral attribution lives in that cookie alone rather than in a readable parameter.
• The account is the email address. A cleared cookie does not create a new identity or a fresh allowance.
• Payout bank details are encrypted at rest and scoped to the signed-in founder. A saved IBAN is never returned to the browser after it is encrypted.
• Third-party credentials are read from environment configuration, never from source. A missing secret refuses the operation; it never defaults open. The upgrade webhook with no configured secret rejects every call, so a forgotten variable means nobody is upgraded rather than that anyone can upgrade themselves.
• No social-platform credential exists anywhere in the system, and a request body cannot assert that one does.

The limits on agent authority

The most important security property of this product is not a control that can be configured; it is a set of capabilities that were never built. A capability that does not exist cannot be enabled by someone misreading a flag.

What the agent may do without a person

• Retrieve and re-check evidence, listings and prices, and record what came back.
• Score, rank, and withdraw its own claims when their evidence ages.
• Generate a storefront, an offer and an ad artefact, and regenerate them.
• Propose a change, cite the row that justifies it, and wait.
• Answer a customer’s question from the product record, or refuse it by name.
• Record an approval.

What it may never do

• Post or comment on any platform. There is no posting function and no import that could become one. Posting is irreversible, outward-facing, and carries the founder’s name to strangers. An approval is recorded as approved; nothing in the process can act on it.
• Charge a card. Generated storefronts run against a payments sandbox and refuse checkout with a stated reason. Live payment is held behind two independent switches and an unresolved pricing-baseline decision, and settlement arrangements are named rather than assumed.
• Buy a domain or launch a paid campaign. Both are outward and cost money. They execute with a person present.
• Apply an edit it proposed. A proposal carries an empty applied-at field by construction, and only acceptance fills it.
• Make an unjustified change. An instruction no dated evidence row supports is refused rather than executed on the model’s taste. An instruction expressed in pixels or hex colours is refused for the same reason: a measurement cannot cite a row.
• State a figure it did not measure. No score at sample size zero, no default supplier price, no fabricated delivery date, no shipping, customs or duty claim in any customer-facing text — the last enforced by scanning the output rather than trusting the instruction.
• Issue a refund, change a price, or alter an order. The support agent answers questions; it holds no authority over money or fulfilment.

Reversibility is declared before the act

Every mutating control states its cost and whether it can be undone before it is used. Reversible surfaces are enumerated explicitly, and applying a change records the previous state so it can genuinely be put back. Anything that spends money or reaches the outside world is not reversible, and says so first. A control whose consequence is discovered after the click is a trap.

What we do not claim

We hold no security certification and we do not imply one. What is written above describes how the product is built; it is not an audit, and it is not a warranty. Our company security posture, data handling and disclosure process are documented under security, data handling and retention and responsible disclosure. The reasoning behind these limits is set out in our safety approach.