Security
Honest posture. No SOC 2 claim (yet). Here's what we actually do.
Credential handling
LinkedIn session tokens are encrypted with AES-256-GCM before being written to the database. Only server functions can decrypt them, and only long enough to make a single Linkup API call. We never store your LinkedIn password.
Data isolation
Every user-owned table has row-level security enabled. Policies scope reads and writes to auth.uid(). We audit RLS on every migration.
Transport
All traffic is TLS 1.2+. Server functions run on Cloudflare Workers; the browser only talks to the app origin and Supabase's PostgREST.
Audit logs
Every pod join, LinkedIn action, and admin escalation writes to audit_log. Logs retained 12 months.
What we don't have (yet)
SOC 2. ISO 27001. Bug bounty. If those are must-haves, we're not the right vendor today.
Threat model
Primary risks we design against: (1) credential theft — mitigated by encryption + no plaintext in logs; (2) cross-user data leakage — mitigated by RLS; (3) LinkedIn account safety — mitigated by human-pace jitter + daily quotas; (4) prompt injection into generated content — mitigated by post-generation lint + user approval queue.
Report a vulnerability
security@agentyaro.com · we respond within 48 hours.