Security Architecture & Practices
Last Updated: August 27, 2026• Official Policy Document
1. API Key Encryption
Secret AI provider keys are encrypted at rest using AES-256-GCM authenticated encryption. Keys are never returned in full in API responses or exposed in client bundles.
2. Row Level Security (RLS)
All database access is governed by strict Supabase Row Level Security (RLS) policies. Users can only read or modify projects, avatars, conversations, and settings that belong to their owner ID.
3. Allowed Domain Security
Public SDK requests are verified against allowed origin domain rules to prevent unauthorized domain usage of developer public keys.