Security
What we do to protect your catalogue.
No decorative badges: these are the specific measures in place today. If you need technical detail for your assessment, get in touch.
Six specific measures. And a seventh for the agents: everything they do is audited.
- 01
Tenant isolation
Every key and reference includes the tenant, and a test suite checks on every release that no operation crosses data between accounts.
- 02
OAuth2 with role-based scopes
Client credentials with read, write and admin scopes. Each credential has the minimum role it needs and can be revoked instantly.
- 03
TOTP MFA
App-based second factor available for every user account.
- 04
Signed anti-replay webhooks
Every webhook is HMAC-signed and includes anti-replay protection.
- 05
Encrypted credentials
Third-party credentials are encrypted with AES-256-GCM, with the master key held outside the database.
- 06
Backups and data in the EU
Regular database backups and infrastructure hosted in the European Union.
- 07
Agents with permissions and audit trail
Agents and assistants connected via MCP use role-based credentials; every change is recorded in the history and can be reverted.
Specific security questions?
We don't display logos for certifications we don't hold. If your procurement process needs a security questionnaire, we'll answer a real one.