A platform like this holds things worth protecting: your products, your prompts, your analytics, and — if you use the shipping and marketing features — credentials to your store and social accounts. "We take security seriously" is the sentence every company writes before the breach post-mortem. So instead of adjectives, here's the actual architecture, in plain words.
The database enforces the wall, not the code
Tenant separation is enforced with row-level security at the database layer. In practice: every query any code runs is automatically constrained to the calling tenant's rows by the database itself. This is materially different from "our code filters by user ID" — in that model, one forgotten filter in one endpoint leaks data, and codebases accumulate endpoints. In ours, the wall holds even when a query forgets to ask politely, because the database was never willing to show other tenants' rows in the first place. The policies are set to apply always, with no privileged bypass in the request path.
Agent runs are sandboxed
Agents execute real code — that's the product — so agent workloads run in isolated environments with locked-down filesystems and restricted network egress. An agent working on your build sees your workspace, not the platform, and its network reach is an allowlist, not the open internet. The same thinking extends to builds of your app's code: untrusted code compiles inside containers whose isolation, not politeness, is the boundary.
Credentials don't wander
Connected credentials — store accounts, social OAuth tokens, deploy keys, Google service accounts — are stored scoped to your tenant, used only for the action you connected them for, and never shown to agents directly: the agent asks the platform to perform the deploy or the upload, and the platform holds the keys. Analytics from shared Google properties is hostname-filtered so your dashboard never shows another site's numbers, even on a property that collects for many.
What we deliberately can't do
The two structural rules that show up in every corner of this platform apply here too: agents cannot spend your money, and cannot post as you — those actions require your click, so the worst day of any automated component doesn't include your wallet or your reputation. Full details, including retention and deletion, live in the Privacy Policy; deletion requests take effect within 30 days.