Tectonic Agents runs autonomous agents with access to your servers, bots, and provider keys — so isolation and secret-handling are the core of the product, not an afterthought. This page describes the controls the platform actually implements.
Every tenant’s data is separated at the database layer with PostgreSQL Row-Level Security. Application queries run through a non-privileged role with RLS forced, and each request pins the active tenant so a query can only ever see that tenant’s rows — even a query with no explicit tenant filter returns nothing for other tenants.
This is verified with live tests: a cross-tenant read returns zero rows and a forged cross-tenant write is rejected by the database policy.
Each customer’s agents run in a dedicated, unprivileged runtime, sealed off from other customers, with a trust-gate that enforces which tools an agent may use and which actions require your approval.
Provider keys and bot tokens are encrypted with envelope encryption: a per-secret data key is wrapped by a key-encryption key, bound to your tenant. Plaintext secrets are never written to logs and are never displayed back to you — token fields are write-only.
Passwords are hashed with Argon2id. Session tokens and agent API tokens are stored only as hashes, so a database read cannot recover a usable credential. Agent tokens are scoped and can be revoked at any time.
All traffic is served over HTTPS with HSTS. The control-plane binds to loopback behind a TLS-terminating proxy; internal services (such as the panel effector) are not exposed publicly. Outbound URLs you provide are validated to block SSRF against internal/metadata addresses.
If you believe you have found a security issue, please contact us through the Discord linked in the footer with details and reproduction steps. We investigate all good-faith reports and ask that you avoid accessing other tenants’ data while testing.
This is a plain-language summary for product use. It is not legal advice. Questions? Use the support or privacy email above once configured, or the Discord link in the footer when set.