Security
Control access to your company’s information.
Company OS checks company membership on the server, gives agents explicit permissions and records document changes. This page explains the application’s access controls, credential handling and data storage. Last updated September 2026.
Tenancy
Company membership is checked on the server.
Every read and every write is checked against your membership on the server, never in the browser. Ask about a company you do not belong to and you get the same answer as for one that does not exist, so nobody can even learn who else is here.
- Roles
- Owners manage everyone. Admins manage members. Members manage nothing. Only owners and admins can connect, reconnect, widen scopes, trigger a sync or disconnect software in the Marketplace.
- Agents are not members
- An agent holds a company-scoped key with explicit capabilities. Revoking it changes nothing about human access, and human roles change nothing about the key.
- Search
- Filtered inside the index by company before ranking, not after.
- Size caps
- Canonical content 256 KB, run payloads 64 KB, feedback 8 KB. Passwords are validated server-side.
Agent keys
Choose permissions for each agent key.
A key is shown once and stored only as a hash. It carries a short list of what it may do (read, write, revert, merge, keep a log) and can be limited to a single department. The endpoint refuses anything outside that list, and the database checks again on the exact page being written.
Every call an agent makes is recorded against its key, so you can always see how an agent used its access. Revoke the key and it is out, with nothing else touched.
Accounts and invitations
Hard to abuse, easy to use.
- Proof of work
- Every password check, sign-up, reset and resend requires a short-lived HMAC-signed challenge bound to the normalised email, the exact purpose, an expiry and an adaptive work factor. After a valid solution only the token digest is stored until expiry, so a proof cannot be replayed. This stops a caller from cheaply burning Scrypt work or draining the email allowance by rotating addresses.
- Email codes
- Verification and reset use separate providers, issue 8-character codes and expire after 15 minutes. Verification is optional and gates nothing.
- Invites
- The plaintext token appears once, in the link fragment, and is moved into per-tab session storage and out of the address bar immediately. Only a SHA-256 hash is stored. A link admits exactly the invited address, expires after seven days, works once, and every refusal returns the same sentence.
- Cross-origin sign-out
- Auth actions from another origin are rejected at the application boundary, under a regression test, in addition to the auth library's own check.
Traceability
Document changes keep an application history.
The application preserves earlier document revisions when you edit or revert a document. Each one keeps its author, its message and a fingerprint of the content. Undoing a change writes the old version forward as a new one, so the mistake and the fix are both on the record.
Changes made on a branch can be reviewed before merging. Agents with document-write permission can also commit directly. Merges and undos show up on the same timeline as everything else.
Company documents / History
Every saved change keeps its author, message and earlier version.
Integration connections
Connected tools keep their secrets.
- OAuth
- Authorization code with PKCE (S256 only), exact redirect match, state of at least 256 random bits used once, access tokens of an hour or less, rotating single-use refresh tokens, and reuse detection that disables the grant.
- Crash-safe capture
- An encrypted recovery request is stored before any token-producing call. If execution stops between the provider issuing a token and Company OS capturing it, the cleanup worker replays the exact request and the provider returns a verifiable cleanup receipt.
- Storage
- Provider credentials never enter browser storage, client-readable queries, URLs, analytics or logs. Disconnect revokes the provider grant before deleting the encrypted local credential.
- Imports
- Read-only by default. Imported records never overwrite canonical documents, and provider versions are append-only, so a delayed older version cannot move the head backward.
Report a security issue
Contact the project owner through GitHub before sharing details about a suspected vulnerability. Do not include secrets or private company data in a public issue.
Contact on GitHubWhere it lives
What is stored, where, and who else ever sees it.
The hosted application uses separate services for its database, files, payments, email and AI. Here is what each receives.
- The record
- Documents, every revision of them, table rows and their versions, branches, merges, events and agent calls live in a Convex database, one per deployment. Every row carries the company it belongs to and every read is filtered by it on the server.
- Files
- Uploaded media goes straight from the browser to an S3-compatible bucket (Wasabi) over a presigned URL. The bytes never pass through the application; the database keeps the filename, size, type and who uploaded it.
- Secrets
- Agent keys, invite tokens and OAuth secrets are stored as SHA-256 hashes, so a copy of the database does not contain a usable credential. Tokens for connected software are encrypted with a key that exists only on the server.
- Payments
- Card details go to Stripe Checkout and the Stripe portal and never touch Company OS. The database keeps the Stripe customer and subscription ids and the plan the webhook reported.
- Sign-in codes, invitations and the digest are sent through Resend. It receives the address and the message; nothing else leaves.
- Models
- AI features send relevant company context to the configured model provider. The Brain uses a connected Stored workspace to index and retrieve company knowledge. Provider retention and training terms depend on that service and its configuration.
- Leaving
- A full export of the company as JSON is on every plan, including free. Uninstalling an app keeps everything it wrote; deleting a company is a request to the operator, described on the privacy page.
Give your team a shared starting point.
Start free with three members and two agent keys. Add your first company document today.