Sicherheit

Verifiable security, not promises

The most sensitive thing you can give Architect is an API key. This page explains the controls that protect it, what the browser can see, and where the key may be sent.

Your API key

Your key is encrypted on the server before it is stored — plaintext is never written to the database.
The storage table has row-level security enabled with zero policies: no browser session — yours included — can read a single row. Only the server's service role can, and it decrypts a key strictly per request.
A user key is only ever sent to the provider's official endpoint (api.openai.com, api.anthropic.com, …) — custom base URLs are ignored for user keys by design.
There is no endpoint that returns a stored key. The only thing any client ever receives is the masked hint.
Deleting a key removes it immediately. Privileged actions on keys are recorded in immutable security audit events.
We recommend connecting a dedicated key with a spending cap set at your provider — then your maximum exposure is the cap you chose, enforced by your provider, independent of Architect entirely.

What your browser can see

After a key is saved, Architect only returns its provider, creation date, and a short masked hint. The complete key is never returned by an API response or rendered in the account page.

Platform security

Uploaded knowledge files are treated as untrusted reference data: they are delimited so their content cannot override system policy, roles, tools, or output rules (prompt-injection defense), and files pass MIME and magic-byte validation with bounded parsing.
Sign-up and recovery are protected by server-verified Turnstile and fail-closed rate limits; you can inspect and revoke your active sessions from your account.
Administrator access requires TOTP two-factor authentication (AAL2). Developer API keys support scopes, expiry, rotation, and per-key quotas.
Content-Security-Policy uses per-request nonces, CSRF protection trusts only the canonical origin, and releases deploy with zero traffic until automated schema, billing, and security checks pass — with automatic rollback.
Payments run entirely on Stripe. Architect never sees or stores full card details.

Found a vulnerability, or have a security question before subscribing? We answer security reports with priority.