Security (Draft for legal review)
Last updated: August 5, 2026
Status: Rough draft — not a SOC 2 report. For counsel and customer security questionnaires, supplement with current audit artifacts.
Principles
- Least privilege & role gates — Privileged admin actions require elevated roles from trusted identity metadata, not client-editable cookies alone.
- Fail-closed entitlements — Paid marketplace packs require an active entitled plan; unpaid installs return payment-required errors rather than silent success.
- Auth-gated APIs — Install, billing, and admin surfaces require authentication (Bearer and/or session cookies).
- Privacy modes — Local / private routing options as described in the DPA and Privacy Policy.
- Credential hygiene — Password breach checks (HIBP) enabled on supported auth surfaces where configured.
- Transport security — HTTPS on production hosts; security headers (CSP with nonces on landing HTML, COOP/CORP where enabled).
Data & subprocessors (summary)
See the DPA for processor / sub-processor detail. Typical categories include: cloud hosting, auth/database (Supabase), LLM providers (e.g. Anthropic), payments (Stripe), and collaboration tools (Slack, Asana) when you connect them.
Vulnerability reports
Email privacy@oliwoods.ai (or security@ if provisioned). Please include steps to reproduce and impact. Do not publicly post exploit PoCs against production without coordination.
Customer responsibilities
- Protect workspace credentials and Slack/Asana tokens
- Review pack permissions before install
- Configure privacy mode appropriate to your data