Your AI gets tools. Never your passwords.

Upstream credentials are envelope-encrypted. Each secret gets its own random data key; that key is wrapped by a versioned master key, so master keys can be rotated without re-entering credentials. Secrets are decrypted only immediately before an upstream request and are write-only afterwards: neither the dashboard nor the API ever returns them.

• Per-secret data keys (libsodium secretbox)
• Versioned master keys for rotation
• Never sent to AI models

Every integration, connection, tool, endpoint and log belongs to exactly one workspace, and every query is scoped to it. An endpoint token is bound to a single MCP endpoint and can only list and call that endpoint’s tools. Tokens are stored as hashes and shown once.

• Workspace-scoped data access
• Roles: owner, admin, developer, viewer, billing
• Two-factor authentication for accounts

Imports and tool calls go through one guarded HTTP client. Only http and https on standard ports are allowed, metadata and local hostnames are blocked, and every resolved address is checked against private and reserved IPv4 and IPv6 ranges. The checked IP is pinned for the request so DNS rebinding cannot swap it, and redirects are followed manually with each hop validated again. Credentials are never forwarded to a different host after a redirect.

• DNS pinning and redirect re-validation
• Optional allowed-host list per connection
• Response size limits and timeouts

Every tool is classified from 0 (read-only) to 4 (financial or irreversible). Endpoint presets and your own policies decide whether a call runs, is denied or needs confirmation, and deny rules always win. A protected action never runs silently: if the AI client cannot ask the user, the call stops until someone approves it in the dashboard.

• Deterministic policy order
• Inline confirmation or dashboard approval
• Imported descriptions checked for injected instructions

Each tool call is recorded with the client, tool, policy decision, result summary and trace ID. Configuration changes, token creation and revocation, and approvals go to a separate audit log. Before anything is stored, inputs, outputs and errors pass through a redactor that removes credential fields and token-shaped values.

• Execution log for every agent action
• Audit log for configuration changes
• Secrets redacted before storage

MCP traffic is limited per endpoint token, per endpoint and per workspace, and upstream rate-limit responses are passed back to the agent with a retry hint. The management API, imports and the contact form are throttled separately.

• Limits per token, endpoint and workspace
• Retry-After on limited responses
• Usage caps per plan

Execution logs are deleted automatically once they are older than your plan’s retention period, from 30 days on the free plan up to custom periods on Enterprise. Credentials are kept until you delete the connection. Deleting a workspace schedules it for permanent deletion after a short safety window.

• Retention per plan
• Daily automatic pruning
• Workspace deletion with a safety window