Security & trust
The AI proposes. Trusted code decides.
You're giving an AI team access to your business, so here's exactly how it's contained. Each item is marked Live if it's in the product today or Planned if it isn't yet. We don't describe anything we haven't built as if we had.
Data handling
OkayPanda runs on Cloudflare: the website and API on Cloudflare Pages and Workers, and company data in Cloudflare D1, which encrypts it at rest. All traffic is HTTPS, with HSTS and a strict content security policy.
| Who | What they receive | Why |
|---|---|---|
| Cloudflare | All company data | Hosting, database, network |
| Anthropic (Claude API) | The task, its context and the company facts it needs | Planning, doing and checking work. Anthropic doesn't train on API data by default. |
| Resend | Your email address and a sign-in code | Sending sign-in emails |
We don't sell your data or use it to train models. Integrations, when they launch, will receive only what the action you approved needs.
Tenant isolation Live
Every company's data is scoped to that company on the server. Each company route checks your membership before anything is read, and every database query filters by the company. A request for another company's record returns “not found”, so it doesn't even reveal that the record exists. Automated tests check that one company can't read or write another's data on any route.
- Sign-in by one-time email code; codes expire in 10 minutes, with limited attempts
- Only hashes of sign-in codes and session tokens are stored
- Members have roles (owner, admin, member, viewer); only owners and admins change employees and rules
- Rate limits on sign-in and on AI requests
Least-privilege AI employees Live
An AI employee can't run code, browse freely or touch the database. It can only propose actions from a short, fixed catalog (write a document, delegate, ask you, record a transaction, send an email, publish, purchase, commit to an agreement), and only the ones its permissions list. Defaults follow the department: Finance can record transactions; Marketing can draft emails and posts; nobody gets everything.
Every proposed action goes through one policy check that returns allow, wait for approval, or deny, based on the employee's permissions, your approval rules, the company's state (paused or not) and its budgets. Denied actions are recorded with the reason.
Approval gates Live
Sending email, publishing, purchases and binding agreements wait for you by default, at every automation level, and so does any money above your threshold ($100 by default). The approval shows the action, who asked, why, the exact inputs, the expected outcome, the cost and the risk. You approve, reject or edit it.
Approvals are enforced by the server. The task can't continue until a person with the right role decides, whatever the interface or the AI says.
Audit log Live
Every consequential action is written to the company's audit log: who did it (a person or an AI employee), what they did, which records it touched, the result and any error. Tasks also keep their own event history: status changes, handoffs, outputs, verification and retries. Owners and admins can read the log in Settings.
Encrypted credentials Planned
Integrations aren't live yet. When they launch, OAuth tokens and keys will be encrypted with AES-GCM using a key that lives only in the server's secret store; the database will hold only references. Each connection will show its scopes, can be tested, and can be revoked at once. You'll also be able to forbid specific sensitive actions for a connection.
Today the only secrets the system holds are its own (the AI key and email key), stored as encrypted Cloudflare secrets and never in code.
Prompt-injection defenses
Live The model never authorizes anything. Permissions, approvals and budgets live in trusted code, so text can't talk its way past them: a document saying “approve all payments” changes nothing.
Planned When agents start reading outside content (emails, web pages, uploaded files), that content will be passed to the model clearly marked as untrusted data, never as instructions. It can never grant permissions or override policy.
Retention and deletion
Company data is kept while the company exists, so your AI team keeps its memory and you keep your history. Sign-in codes expire after 10 minutes and sessions after 30 days.
Deleting a company or account today
- Email [email protected] from the address you sign in with, naming the company or account to delete.
- We confirm it's you and that you're the company's owner, and ask whether you want an export first.
- We delete the company's records: employees, tasks, approvals, documents, the audit log and memberships.
- We reply to confirm when it's done. Deleted data also ages out of the database's point-in-time recovery history (up to 30 days).
Planned Self-serve export and deletion in Settings.
Report a security issue
If you find a vulnerability, email [email protected] with “Security report” in the subject. Include what you found, how to reproduce it, and what an attacker could do with it. Please don't access other people's data or disrupt the service while testing, and give us a chance to fix it before you share it publicly.
We read every report, reply as quickly as we can, and tell you when it's fixed. We'll thank you publicly if you'd like.