Security

The application runs on Vercel. Your workspace data, sign-in and uploaded files live in a managed Postgres database on Supabase. Every page and API is served over HTTPS only, with HSTS and preload.

• Every table has row-level security keyed to your workspace, so a signed-in session can only read and write its own workspace's rows.
• Server paths that use a privileged database connection, such as the REST API, the MCP connector and AI requests, filter every query by your workspace explicitly.
• Automated tests fail the build when a write route an API token can reach skips its role check, or when an agent's write tool can run without one.

• Email and password, or Google.
• Two-factor authentication with an authenticator app, plus ten single-use recovery codes stored only as hashes.
• Workspace owners can require two-factor authentication for everyone.
• Admins can reset a member's two-factor authentication when they lose their device; each reset is recorded in the audit log.

API tokens are created by admins and owners, can never exceed the role of the person who created them, are stored only as hashes, and stop working when that person is demoted or leaves.

• Claude, Codex, Cursor and other MCP clients sign in with OAuth 2.1 and PKCE; there is no token to copy.
• Access tokens last an hour. Refresh tokens rotate on use, and reusing an old one revokes the connection.
• An agent acts with the current role of the person who connected it, checked on every write. Deletes, unlinks and merges go through a separate tool that clients mark as destructive.
• ProductOS tokens are redacted from tool output and session transcripts.
• Every connection is listed in Settings, API Tokens, where it can be revoked.

Integration credentials, OAuth tokens for connected tools and saved API keys are encrypted with AES-256-GCM before they are stored. Integration settings show them masked.

• Changes made by people, API tokens, agents over MCP, integrations and webhooks, with who made them and from where.
• The log is append-only in the database: entries can't be edited, and only an owner deleting all workspace data removes them.
• Admins and owners can read the whole log; everyone else sees their own entries. It can be exported as CSV or JSON through the API.

A Content Security Policy, HSTS with preload, X-Frame-Options: DENY (only embeddable roadmap views can be framed), nosniff, a strict referrer policy, and a Permissions-Policy that turns off the camera, geolocation and payment APIs and allows the microphone only to ProductOS itself, for speaking notes.

• AI requests are made from ProductOS's servers to Anthropic, with the workspace context the request needs, for example your vision, OKRs and the records you are working on.
• Semantic search sends feedback text and search queries to OpenAI to create embeddings.
• ProductOS doesn't train models on workspace data.
• An admin can switch off AI actions that change records from the AI panel.

• Export the whole workspace to Excel at any time, from Settings or through the MCP connector, whose download links expire after 15 minutes.
• Trashed records can be restored; admins and owners can delete permanently.
• Owners can delete all of a workspace's product data from Settings.
• To close an account or delete a workspace entirely, email support@productos.ca.

• A SOC 2 report or ISO 27001 certification.
• SAML single sign-on and SCIM provisioning (planned).
• Self-serve account and workspace deletion; support handles it today.
• A choice of data region.

Found a vulnerability? Email support@productos.ca with Security in the subject line, and please give us a chance to fix it before sharing it.