Security

Secrets at restCopy Anchor Link

• Database credentials and integration tokens (Vercel, Netlify, Clerk keys, webhook signing secrets) are encrypted at rest with AES-GCM before they touch the metadata store.
• API keys are never stored. Only a SHA-256 hash of the key material is kept; the plaintext is shown once at creation. A database leak does not yield usable keys.
• Terminal job payloads are scrubbed so plaintext secrets do not persist in the job queue after completion.

Scoped accessCopy Anchor Link

• API keys carry explicit scopes, and keys created with a project_id are confined to that single project - they cannot touch sibling projects, manage other keys, or mutate the organization. Use them for CI. See Authentication.
• Destructive operations (project delete, overwrite-restore, key management) require the org admin role for human sessions or an org-wide API key an admin created; project-scoped keys cannot reach them, and neither can a member key - the key minted when a workspace member without the admin role connects an MCP client, which the dashboard's Settings → API keys list marks with a Member key badge. A member key can do what its scopes allow and nothing a member's own session could not. Imports and credential rotation need the same authority. Where it matters most, a single-use approval token is required as well (deleting a production project, every overwrite restore), and only a person can create one: an org admin signed in to the dashboard. API keys - including the organization-wide key an agent receives from device login - cannot mint approvals, so no caller can approve its own destructive action. Overwrite restore is refused on production projects altogether.
• Every project-affecting action lands in the project audit trail.

TransportCopy Anchor Link

• Database connections require TLS (sslmode=verify-full in every URL CapyDB hands out). verify-full validates the certificate chain and the hostname, so a machine-in-the-middle cannot present a substitute certificate.
• The API and dashboard are HTTPS only. Outbound webhooks are HTTPS only, signed with HMAC-SHA256, and receiver URLs must be public addresses (no SSRF into private ranges - the same guard applies to import sources).

InfrastructureCopy Anchor Link

• Databases run on dedicated-vCPU servers in the EU; the control plane runs on a separate EU server. Data residency is EU.
• The operational tooling fails closed: the backend refuses to start with development credentials outside of explicitly insecure local modes, and executors must be configured deliberately rather than defaulting to something permissive.

Honest postureCopy Anchor Link

CapyDB is a young product. There is no SOC 2 report and no HIPAA eligibility today - if your compliance regime requires those, we are not your host yet, and we would rather say so here than in a sales call. The full picture of what procurement can and cannot rely on is in Compliance. Questions about the security model, or something to report: contact support and a human who works on the backend will answer.