Security

• Encryption in transit: all traffic to the app and API uses HTTPS (TLS).
• Encryption at rest: the database and its backups are encrypted at rest by our hosting provider (EU, Ireland).
• Encrypted AI keys: your own AI provider key is encrypted with AES-GCM using a server-side secret, is never shown again after saving and can only be decrypted by server code.
• Per-agent secret tokens: each agent has its own random token; invalid tokens are rejected and you can delete an agent at any time.
• Redaction by default: emails, phone numbers, card numbers, IBANs and ID numbers are masked, and large blobs removed, before anything is stored or sent to an AI provider.
• Retention: logs are deleted automatically after 7, 30 or 90 days, as you choose.
• Access control: row-level security ensures each account can only read its own agents, events and alerts; privileged operations run only on the server.
• Abuse limits: payload size limits and alert flood caps.

To report a vulnerability, write to hola@groundstop.eu.