Security
Your apps, docs, decks and agents on one canvas, kept to your workspace.
What we do to protect it, said plainly, and only what is true today.
Your data
How it travels, where it is kept, and what we measure.
HTTPS only
Every page is served over HTTPS, and browsers are told to use nothing else for a year, on every subdomain (HSTS).
No framing, no device access
Other sites can’t embed our pages, and the browser keeps the camera, microphone and your location closed to them.
Page counts without cookies
We count visits with Vercel Web Analytics, which sets no cookie and keeps no identifier on your device. No advertising or cross-site tracking cookies.
Where it runs
Every service that processes customer data for us, and what each one does, is on the sub-processors page. See the sub-processors
Access
Who can get in, and what each of them can do.
Every row checked against who you are
The database checks who you are on every row it returns (row-level security), and a test fails if any table goes without it.
Roles, checked in the database
Teams have owners and members, and each permission is checked by the database on every read and write, not only in the app.
Two-factor sign-in
Any account can turn on an authenticator app. From then on, signing in asks for its code, and the database refuses your data to a session without it.
Agents and the canvas
What happens when your agents connect, and where your apps run.
Agent tokens stored as hashes
Agents connect over MCP with OAuth and PKCE. We keep only a SHA-256 hash of their tokens, never the tokens themselves.
Connected services, encrypted
The tokens for services you connect, such as GitHub, are encrypted before they are stored.
Your apps run on their own origin
The apps you build run from a separate origin, apart from your Prototyper session.
How we run it
The controls behind the product.
Our own access is logged
When we act on an account, the action and our reason are written to an append-only log before it runs.
Checked changes
Every change ships through a merge queue whose checks include the database’s access tests.
Report a vulnerability
Found something? Email security@prototyper.co, the contact in our security.txt. We reply to every report and tell you when it is fixed.
Research in good faith is welcome: don’t access more than you need, don’t destroy data or disrupt the service, and give us a chance to fix it before you tell anyone else.