Built like the data belongs to you.
This page is maintained by the Assistant.bd team to answer common security questions. It describes shipped controls, not future promises. It is not a certification statement.
What's in production today.
Row-level security
Every application table is RLS-enabled. Policies scope reads and writes to workspace membership; the database rejects unauthorized queries before they leave Postgres.
Per-user OAuth 2.1 (MCP)
External assistants connect via the MCP OAuth 2.1 authorization server. Tokens carry a real user identity; no shared service tokens are issued to third-party clients.
Auditable task history
Every agent task is persisted with inputs, outputs, and lifecycle. Nothing runs silently — you can review or replay any run from the console.
Signed webhooks
Provider webhooks (Stripe, Shopify, Firecrawl) are verified with their native signature schemes and deduped before enqueue. Unsigned requests are rejected.
Least-privilege service keys
The service-role key is used only for verified webhooks and admin maintenance, never as the default read path. Public read APIs go through a publishable-key client under narrow anon policies.
Encrypted at rest and in transit
Data is stored in Supabase-managed Postgres with encryption at rest. All external traffic terminates on TLS 1.2+.
Who processes your data on our behalf.
Optional subprocessors are only engaged when the workspace owner connects them. Data never crosses into a subprocessor you haven't explicitly enabled.
| Subprocessor | Purpose |
|---|---|
| Supabase | Managed Postgres, auth, storage, edge functions. |
| Cloudflare | Edge runtime for server functions and public API routes. |
| Lovable AI Gateway | Model routing for text and image generation. |
| Stripe | Optional — payments webhooks when enabled by the workspace owner. |
| Shopify | Optional — order webhooks when a Shopify connection is added. |
| Firecrawl | Optional — web crawl callbacks for research agents. |
What we secure vs. what you secure.
We secure
- • Platform infrastructure and network boundaries
- • Database RLS enforcement and auth session integrity
- • Webhook signature verification for shipped providers
- • MCP OAuth 2.1 issuer and token audience validation
You secure
- • Which connections you grant to which workspace
- • Which team members you add and at what role
- • The prompts and instructions your agents follow
- • The scope of tools you approve for external MCP clients