AutomatePalTrust
Security at AutomatePal
What protects workspaces today, who processes data, and what is not in place yet. AutomatePal is a fictional-data preview, so treat everything here as preview controls, not a production assurance.
Last updated
At a glance
| Area | Status | Detail |
|---|---|---|
| Encryption in transit | In place | HTTPS only, with HSTS on every response. |
| Encryption at rest | Provider | Supabase encrypts stored data at rest. |
| Tenant isolation | In place | Postgres row-level security, tested with two populated workspaces. |
| Payment execution | Off | Sandbox reads only. No live payments, captures or refunds. |
| SOC 2 / ISO 27001 | Not held | No third-party attestation yet. |
| HIPAA / BAA | Not offered | Do not store health information. |
| DPA | Not offered yet | A data processing agreement is not available today. |
| Penetration test | Not done | No independent test has been run. |
Workspace isolation
Every workspace's rows live in the same Postgres database and are separated by row-level security, so a signed-in user's queries only see their own workspace's data. Database functions check the caller before they read or change anything.
Automated tests run two synthetic workspaces side by side, each with cases, published and private knowledge, tokens and audit events. They confirm that one workspace cannot read, overwrite, revoke or delete the other's data, and that deleting one leaves the other intact.
Access and secrets
- Sign-in uses Google or an email sign-in link through Supabase Auth. The app accepts only confirmed email addresses and never sees your Google password.
- API tokens are shown once, stored only as a SHA-256 hash, scoped to support, analytics or health data, expire after 1 to 168 hours, can be revoked, and are capped at five active per workspace. They read metadata only.
- Webhooks are signed with HMAC-SHA256 over the timestamp and the raw body. The signing key cannot be read back from the browser. Deliveries resolve the destination to a public address, refuse redirects and are size- and time-limited.
- Demo links expire after one hour.
Data handling
- Answers come only from sources you published, and source text is sent for AI processing only after you consent.
- Owner actions are recorded in an audit log that keeps IDs, resource type, operation and time only, never message text, contact details, URLs or secrets. The latest 1,000 events are kept per workspace.
- Operational logs hold error codes and timings, not message text or personal data. They are visible for 7 days.
- Owners can delete their preview data themselves after typing a confirmation. What this does and does not remove is listed in the privacy notice.
Application security
- API inputs are validated against schemas with body-size caps, and writes check the request origin.
- A per-identity rate guard limits repeated writes, and answer budgets (20 per conversation, 100 per workspace per day) are enforced before any AI call.
- Responses carry HSTS, a Content Security Policy that blocks outside scripts and plugins,
nosniff, a no-referrer policy and a permissions policy that disables camera, microphone, location and payment APIs. Pages refuse to be framed by other sites, except the support widget frame that customers embed. - Private pages and APIs are never cached and are kept out of search engines.
- The dependency audit reported no known vulnerabilities at the last check on October 31, 2026.
Infrastructure
The app runs on Render. Sign-in and the database run on Supabase in AWS us-east-1. Supabase states that customer data is encrypted at rest with AES-256 and in transit with TLS (Supabase security). Payment calls are locked to PayPal's sandbox; the server refuses any other PayPal address.
Service providers
These providers process data so AutomatePal can work. Each has its own terms and privacy policy.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Sign-in, Postgres database and vector search | Account email and profile, workspace content, knowledge sources, tickets and audit metadata | AWS us-east-1 (United States) |
| Google Gemini API | Answer generation, embeddings and grounding checks | Visitor questions and source text you consented to process | Google-managed |
| Google Sign-In | Identity provider for Google sign-in | Email, name and basic profile | Google-managed |
| Render | Application hosting | Requests in transit; the fictional sandbox activity ledger on the instance disk | Render-managed |
| PayPal (sandbox) | Read-only sandbox catalog and plan data | No customer data is sent | PayPal-managed |
| GitHub | Public evidence for Proof-to-Pay checks | Public commit and check data only | GitHub-managed |
Free-tier Gemini content may be used by Google to improve its products, which is one reason this preview accepts fictional data only.
Not in place yet
These are open gaps, not plans with dates:
- No SOC 2, ISO 27001, HIPAA or GDPR certification, no BAA, and no signed data processing agreement.
- No independent penetration test.
- Hosting is on free tiers: the app can sleep or restart, there is no uptime SLA, and the database has no managed daily backups or point-in-time recovery. A restore has not been rehearsed.
- No single sign-on (SAML or OIDC) and no multi-factor authentication beyond what your Google account enforces.
- No 24/7 monitoring or on-call. One maintainer reviews reports manually.
Report a vulnerability
Email raviteja@automatepal.com with a subject line starting [security]. Include the affected page or demo-link URL, what you observed and when. Do not include secrets, credentials or other people's personal data.
Reports are reviewed manually by one maintainer. No response time or fix timeline is promised. Good-faith research reported this way will not be treated as hostile. Please test only against fictional data; none of it should be real. The machine-readable policy is at /.well-known/security.txt.