Gate97Security
Credential encryption
Every credential you save — an OAuth token, an API key, a password — is encrypted at rest with AES-256-GCM before it touches the database, and only decrypted in memory for the moment a real API call needs it. The encryption key is never stored in the database itself.
Tenant isolation
Every organization's data is isolated at the database level using Postgres row-level security, not just application-level checks — a query can't read another organization's connections, workflows, or run history even if it were somehow crafted to try, because the database itself enforces the boundary underneath the application code.
Passwords
Account passwords are hashed with Argon2id, the current recommended standard for password hashing — never stored or logged in plain text.
Transport
All traffic to and from Gate97 is served over HTTPS.
Rate limiting
Sensitive endpoints — sign-up, login, password changes, incoming webhooks — are rate-limited to curb abuse. Outbound calls to connected apps are rate-limited per connection too, so one organization's activity can't exhaust a shared provider's API limits for anyone else.
Account suspension
A suspended account or organization is signed out immediately, on its very next request, rather than just blocked at the next login attempt.