Security
How Tessallate protects your workspaces, and the controls you have.
Access
- Roles per workspace (owner, editor, viewer), enforced the same way in the app, the API, GraphQL and every AI app connection.
- Row-level access rules and field masking for editors and viewers.
- AI apps sign in with OAuth and you choose which workspaces each one can reach; grants and API keys can be revoked any time.
- Passwords are hashed with scrypt; sessions can be signed out everywhere; reset links are single-use and expire after an hour.
Data protection
- Encrypted in transit (HTTPS). Connection credentials and API secrets are encrypted at rest.
- Optional per-field encryption with a per-workspace key, and crypto-shredding by destroying the key.
- A data boundary switch that blocks every server-initiated outbound call (webhooks, syncs, server-run AI) for a workspace.
Safety nets
- Every change, by a person or an AI, is recorded with who made it and can be undone.
- Agents can be required to ask for approval, have spend and run caps, and are saved paused when created from a chat with broad permissions.
- Validation rules are checked on every write path.
- An exportable audit log (CSV/JSON) of every change.
Abuse protection
- Rate limits on sign-in, sign-up, the MCP endpoint, the API, forms, capture and webhooks.
- Webhooks to private network addresses are blocked; inbound webhooks require a secret.
Reporting a vulnerability
Contact whoever runs this server.