Tectonic Agents runs autonomous agents with access to your servers, bots, and provider keys — so isolation and secret-handling are the core of the product, not an afterthought. This page describes the controls the platform actually implements.
Each customer’s data is separated by account boundary, and requests are scoped so your account can only access its own servers, agents, activity, and settings.
The platform verifies that cross-account reads return no data and that unauthorized cross-account writes are rejected.
Each customer’s agents run in an isolated workspace, sealed off from other customers, with guardrails that enforce which tools an agent may use and which actions require your approval.
Provider keys and bot tokens are encrypted before storage and bound to your account. Plaintext secrets are never written to logs and are never displayed back to you — token fields are write-only.
Passwords are hashed with Argon2id. Session tokens and agent API tokens are stored only as hashes, so a database read cannot recover a usable credential. Agent tokens are scoped and can be revoked at any time.
All traffic is served over HTTPS with HSTS. Internal services are not exposed publicly, and outbound URLs are validated to prevent access to private or metadata-only addresses.
If you believe you have found a security issue, please contact us through the Discord linked in the footer with details and reproduction steps. We investigate all good-faith reports and ask that you avoid accessing other customers’ data while testing.
This is a plain-language summary for product use. It is not legal advice. Questions? Use the support or privacy email above once configured, or the Discord link in the footer when set.