What your security team will ask, answered.

Every connection stores its credentials in Supabase Vault, not in a database column. The Vault secret holds a JSON blob with the keys or tokens and, for OAuth connections, an expiry. The database only holds a reference to the Vault secret. The credential is decrypted inside the tool executor for the duration of one call, held in memory, and discarded. It is never written to logs and never returned in an API response.

Vault secrets are encrypted at rest with AES-256. Traffic to the API runs over TLS 1.2 or higher. API keys are stored as a bcrypt hash. Only the first twelve characters are kept in plaintext, so the dashboard can show you wsk_live_abc12345... without being able to reconstruct the key.

Every tool call writes an immutable record: workspace, API key, integration, tool name, a SHA-256 hash of the input, success or failure, error code, and latency. The raw input is never stored, only its hash. Records stay queryable in Postgres for 90 days and are archived after that. On the Scale plan you can export the stream to your own SIEM.

A connection belongs to exactly one workspace. Every tool call resolves the workspace from the API key, then checks that the connection it is asked to use belongs to that workspace before it runs. Rate limits and usage counters are per workspace. There is no shared connection pool across tenants.

Application and database infrastructure run in the EU and KSA. Wassel is built to meet Egyptian and Saudi data protection law. Service responses pass through the executor and are returned to your agent. They are not retained beyond the audit record described above.

Report anything you find to security@wassel.cloud. We acknowledge within two business days and will keep you posted while we fix it. We do not pursue researchers who act in good faith and avoid privacy violations and service disruption.

We run an external penetration test before general availability and at least once a year after that. SOC 2 Type II is in progress. We will publish the report summary on this page and share the full report under NDA on request.

If credentials in a workspace are exposed, we revoke the affected Vault secrets, rotate what we can, and notify the workspace owner with the timeline and scope. We aim to make first contact within 24 hours of confirming an incident.