Security

Workspaces

Each workspace is separate. The app routes that read memory require a signed-in account. A signed-out visit is sent to login. API and MCP routes require a workspace credential. A key is stored as a SHA-256 hash and a short prefix. The full key is shown once. Revoking a key stops it on the next request.

Credentials and passwords

Connector credentials are encrypted at rest with AES-256-GCM before they are written. The key comes from the environment, not from the repository. Passwords are hashed with scrypt and a unique salt. The database does not keep the password.

Sign-in can use email and password. Google and GitHub sign-in appear when those Auth.js flags are enabled. A magic link appears when that flag is enabled. If a flag is off, the button is unavailable. That is a configuration state, not a promise that the button will appear later.

What is connected

OAuth state for a connector is kept in a short-lived cookie (archilas_integration_state) so the callback matches the request you started. Gmail, Google Calendar, and Google Drive are read through Composio. Other implemented connectors use their own OAuth apps. Discord and Microsoft Teams are not implemented.

Context sent to a model

This repository does not train a model on customer content. Generating an answer sends relevant notes to OpenRouter. Archilas does not sell that content. Provider retention is governed by OpenRouter’s terms and the account settings there. The privacy policy is the full statement.

Your copy, and deletion

A signed-in member can download a JSON export at /api/account/export. Deleting the account from Settings removes the user and the workspaces they solely own. Deletion is refused while another member is still in a workspace they own. You can also email hermes@archilas.com.

The code does not define how long a database backup keeps a deleted row. This page does not invent that period.

Hosting

The app is built to run on Vercel. The database is Postgres. When the host is Neon, the code uses Neon’s pooled connection. Upstash Redis is used for the waitlist only when those environment variables are set. Paid charges, when they are made, go through Lemon Squeezy as merchant of record. Card numbers are not stored here.

What we do not claim

• No SOC 2, ISO 27001, or other certification.
• No penetration test or bug bounty is described in this repository, so none is claimed.
• No promise that every connector is configured in every deployment. A connector needs its environment variables.

To report a security issue, email hermes@archilas.com. A data processing addendum is available on request at the same address.