Security

Your agents' activity is your business. Here is how we keep it that way.

Your data stays yours

• Walled off in the database. Every workspace's rows are separated by row-level security in PostgreSQL itself, so a mistake in our code can't show one customer another customer's data. The application runs as a database user that cannot bypass it.
• Agents only send data out. Agents report to us over HTTPS; nothing on our servers can reach into your machines.
• We store what the dashboard needs. Agent state, the task line, plan check-ins, machine names. Not your code, prompts or files.

Keys and sign-in

• Each agent has its own key. Keys are stored only as hashes, shown once, saved straight to a file only your account can read, and revocable one by one.
• Setup tokens work once and expire after 15 minutes.
• Two-factor sign-in (passkeys or an authenticator app) is required for anyone who can create agent keys.
• Passwords are hashed with Argon2id and checked against known breaches. Sign-in attempts are rate limited.
• Changing roles, exporting data or deleting a workspace asks you to confirm who you are again.

In transit and at rest

• HTTPS everywhere, with HSTS. Strict Content-Security-Policy on every page.
• The database is reachable only from our hosting provider's private network, never from the internet.
• Two-factor secrets are encrypted. Point-in-time database backups for 7 days.

Accountability

• Every workspace has an audit log: sign-ins, keys issued and revoked, role changes, exports.
• You can export everything in your workspace, or delete your account and its data, from the dashboard.
• Payments are handled entirely by Stripe. Card details never touch our pages or servers.

Reporting a vulnerability

Email security@agentsoverwatch.com. Please give us a reasonable time to fix it before telling anyone else. We won't take action against good-faith research that avoids other people's data and doesn't disrupt the service.