Authentication
Handled by Supabase: password, magic link, and Google OAuth. No credentials of our own invention.
Tenant isolation
Row-level security is enforced at the database layer for all tenant data. Isolation is a database guarantee, not an application convention.
MCP tokens
Each token is scoped individually and can be revoked at any time. Revoking a token cuts that agent's access immediately.
Payments
Handled by Stripe. We never store card data.
Encryption
All traffic is encrypted in transit.