Security

Security and data protection are fundamental to our platform. We implement industry-leading practices to safeguard your data and ensure the integrity of our services.

Data Security

Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3, the latest industry standard.

Encryption at Rest

Sensitive data including passwords and integration credentials are encrypted at rest using AES-256 encryption.

Password Security

Passwords are hashed using bcrypt with per-user salts. We never store plaintext passwords.

Database Protection

Production databases use encrypted connections, access controls, and regular automated backups with point-in-time recovery.

Access Controls

Authentication

Enterprise-grade authentication via Clerk with support for SSO, MFA, and secure session management.

Role-Based Access

Granular permissions ensure users only access data within their organization and role scope.

API Security

Agent API keys use workspace-scoped access, HMAC request signing, rate limiting, and one-time approval tokens.

Network Security

Private network isolation for sensitive services, with explicit CORS policies and DDoS protection.

Infrastructure Security

Hosted on enterprise-grade cloud infrastructure (Railway, Vercel)
Automatic security patches and updates for all dependencies
Regular vulnerability scanning and dependency audits
Distributed denial-of-service (DDoS) protection
Web application firewall (WAF) protection
Structured logging and real-time error monitoring with Sentry
Redis-backed rate limiting across all public endpoints

Application Security

Input validation and sanitization on all user inputs
SQL injection protection via parameterized queries
Cross-site scripting (XSS) prevention
Cross-site request forgery (CSRF) protection
Server-side request forgery (SSRF) prevention for web crawling
Secure session management with automatic timeout
Audit trails for all critical actions and data changes

Data Privacy & Compliance

We are committed to protecting your privacy and complying with data protection regulations:

GDPR-compliant data processing for EU users
CCPA-compliant for California residents
Data minimization - we only collect what's necessary
Right to access, correct, and delete your data
Data export functionality for portability
Regular privacy impact assessments

AI & Third-Party Security

We carefully vet and monitor all third-party services:

AI providers (DeepSeek, OpenAI, Gemini) selected for enterprise security
No training on your data - strict zero-retention policies
Fallback providers for resilience and availability
Integration credentials encrypted with workspace-specific keys
Regular review of third-party security posture
Minimal data exposure principle for all external calls

Incident Response

In the unlikely event of a security incident:

24/7 monitoring and alerting for suspicious activity
Documented incident response procedures
Prompt notification to affected users
Transparent communication about impact and remediation
Post-incident review and security improvements
Coordination with law enforcement when appropriate

Business Continuity

Automated daily backups with 30-day retention
Point-in-time recovery capability for databases
Geographically distributed infrastructure
Documented disaster recovery procedures
Regular backup restoration testing
99.9% uptime SLA for enterprise customers

Report a Vulnerability

We take security seriously and appreciate responsible disclosure of any vulnerabilities.

Security contact: security@signaganic.com

Please include detailed steps to reproduce, potential impact, and any relevant technical details. We commit to acknowledging reports within 48 hours and providing regular updates on remediation.

Questions?

For questions about our security practices, contact us at security@signaganic.com or review our Privacy Policy.