Data you can defend
One backend decides every rule. Web, mobile, and AI clients only call the API, so nothing bypasses authorization or validation. Roles are checked on every request, credentials are hashed, and every save is written to an audit log you can read.
How the platform is built
- The backend owns every rule
- Authorization, validation, business rules, and persistence live in one place. A client, including an AI agent, cannot save something the rules refuse or read something its role does not allow.
- Permissions checked on every request
- Membership and role are read per request, never cached in a token. API tokens and AI clients are intersected with the member's live role, so a demoted member's token shrinks with them.
- Credentials at rest
- Passwords are hashed with argon2. API tokens are hashed and shown once. Refresh tokens rotate on every use and detect replay, which ends the whole session family. Sessions can be listed and revoked.
- One platform admin
- Exactly one, created from the command line, on its own host with its own sign-in, re-checked on every request, and never reachable with an API token.
- Two database roles
- The application connects as a role that can only read and write rows. Schema changes run separately as a migrator role, so a compromised app cannot alter the schema.
- Files checked by content
- Uploads are typed from their real bytes, not their name. Private files sit behind access-checked links that expire. A file cannot be deleted while a response relies on it.
- Rate limits and idempotency
- Sign-in, one-time codes, public submissions, and analytics each have their own limits. Submissions are idempotent, so a retry never duplicates a response.
- An audit log that includes agents
- Workspace actions, consent grants and withdrawals, admin actions, and every save an AI client makes are logged with who, what, and when.
AI clients hold less than you do, always
An AI client connects by signing in through your browser with OAuth 2.1 and PKCE, never by pasting a secret into a config file. Approval mints a workspace token capped by your role. The client can draft and edit forms, but there is no publish tool, invalid saves are refused, and a stale edit is refused rather than overwriting someone else's work.
- Sign-in, not secrets
- OAuth 2.1 with dynamic client registration and PKCE. Approval happens in your browser.
- Capped
- The token is intersected with your live role on every request.
- Drafts only
- No publish tool exists. Invalid and stale saves are refused.
Where your data lives
- Responses, forms, consent, audit
- PostgreSQL, operated for the hosted service in AWS Mumbai.
- Files and attachments
- An S3-compatible object store in the same region; private files served through short-lived signed links.
- Transactional mail through a provider in the same region. No answer content is sent by email except to the respondent's own address.
- Search embeddings
- Optional. Answer text is sent to Voyage AI in the United States under zero-day retention; the resulting vectors are stored in your own database. Turn search off and nothing leaves the region.
Respondents are protected too
Per-purpose consent, chained receipts, a private rights link, guardian consent for children, and a grievance contact are built into every campaign. The DPDP page walks through each one.
What is not built yet
SSO, a breach register, and automatic erasure at the end of a retention period are on the roadmap. Hosted MCP access over HTTPS is being finished. There is no third-party audit report yet; the decisions record and the test suite are public instead.
Questions people ask
Who can see a workspace's responses?
Members whose role includes responses.read, checked on every request. The platform admin has no route to response data through the API.
Can an API token be used to administer the platform?
No. Tokens belong to one workspace and are refused for platform administration by design.
What happens if a member leaves?
Removing them ends their sessions, and any token they created is intersected with a role they no longer hold, which makes it useless. Ownership can be transferred first.
Do you have a security audit or certification?
Not yet. The engineering decisions and tests are public, and we will answer a security questionnaire in a walkthrough.
Bring your security questionnaire
Book a walkthrough and we will answer it line by line, with the decisions record open.