v0.1 — review pending

Security

Last updated: 2026-07-24

Our principles

Security is the #1 pillar of rendfly. The product handles end-user PII that can appear inside the span attributes you export, and provider API keys (real-money access). Traffic through our proxy is captured as metadata only - your prompts and replies are never stored. The supreme rule: never trust the frontend. All authorization, validation, and tier-gating happen server-side; the SvelteKit frontend is purely UX.

Eight principles every change is judged against:

  1. Defense in depth - multiple layers, never one safeguard alone.
  2. Least privilege - minimum permission per service and per user.
  3. Secure by default - PII redaction and mutation audit logging are on by default. MFA is planned.
  4. Fail closed - when uncertain, refuse.
  5. Auditability - supported sensitive mutations are logged append-only.
  6. Data minimization - proxy capture stores metadata only, and raw PII is redacted out of exported span attributes before storage.
  7. Threat-informed - designed against real attackers, not compliance theater.
  8. Transparency to customer - you can see what data is held and how.

Day-1 hard requirements

  • TLS 1.3 everywhere
  • AES-256-GCM at rest for sensitive columns (provider keys)
  • PostgreSQL row-level security on every multi-tenant table - scoped to workspace_id
  • Argon2id password hashing, short-lived (15 min) JWT plus refresh tokens
  • HttpOnly + SameSite=Lax cookies; CSRF protection on state-changing routes
  • PII redaction before storage
  • No model call in the detection path - detectors are deterministic over span metadata, so nothing an end user writes to your agent can steer what we detect or report
  • Per-workspace rate limiting
  • Append-only audit log for supported sensitive mutations
  • Secrets in Vault (or encrypted env in MVP-light)
  • Dependency and secrets scanning in CI (govulncheck, gitleaks)

Compliance roadmap

  • Day 1: LGPD (Brazil) and GDPR (EU) compliance.
  • Month 6: SOC 2 Type I.
  • Month 12: SOC 2 Type II.
  • Month 18+: ISO 27001.

Current status: SOC 2 in progress.

Reporting vulnerabilities

If you have found a security issue, please email [email protected]. Include reproduction steps, affected endpoints, and your contact info. We acknowledge within 24 hours and aim to resolve high-severity issues within 7 days. We do not currently run a paid bug bounty, but we credit reporters publicly with their permission.