Security and privacy

Built so the safe thing is the default

Residency, minimal collection and tenant isolation are properties of the architecture, not settings you have to find.

Residency

Each project lives in one region, chosen at creation and never moved. EU is live; UAE, US and Pakistan open as their in-country infrastructure is ready.
End-user data and everything derived from it (people, identity graphs, recordings, AI answers, findings) is stored and processed only in that region.
Queries go straight from your browser or API client to the region with a short-lived signed token. Results never pass through the control plane.

IP addresses are never stored. Ingest resolves the location, then drops the address, and our public web servers keep no access logs for ingest.
Session replay is masked on the device: inputs by default on the web; all text and inputs by default on mobile. Masked content never leaves the device.
The web SDK redacts secrets from URLs (tokens, passwords, codes, emails, phone numbers) before they leave the page.
Erasure is one API call: invisible within an hour, purged within 72 hours, out of backups within 35 days, with an Ed25519-signed certificate anyone can verify.
Consent is built into every SDK: pending holds events in memory, denied sends nothing and wipes stored state, and the browser SDK has a cookieless mode.

Every query is compiled with your project and environment forced into every table reference.
Customer SQL is parsed against an allowlist, then limited again by row policies in the database, and audited by sampling the query log.
Another tenant's resources answer 404, never 403, so their existence cannot be probed.

Passwords are hashed with Argon2id; sessions and API tokens are stored only as hashes, and secrets are shown once.
API tokens carry explicit scopes that can only narrow, never widen, and are re-checked against the owner's role on every call. Sensitive actions (production flags, shipping experiments, raw SQL, unmasked personal data, billing, members) need named scopes that nothing implies.
Assistants connect over OAuth 2.1 with PKCE and dynamic client registration; each connection can be revoked on its own.
Provider secrets (revenue webhooks, alert destinations) are encrypted with AES-256-GCM and never returned.
Changes are written to an append-only, hash-chained audit log that records whether a person, a token or the system made them.

The platform is AGPL-3.0 and the SDKs are MIT, so you can read exactly what is collected and how it is stored.
The web SDK is 7.7 KB gzipped and never throws; the session-replay recorder downloads only for recorded sessions.

A console screen for erasure requests (the erasure API is live).
An independent penetration test and a fuzz corpus for the SQL compiler before general availability.
A data processing agreement and published sub-processor list.