Security overview

Access

• No passwords. You sign in with Google or Microsoft, or with a one-time code emailed to your invited address (six digits, used once, expires after ten minutes, five tries, limited requests per address, stored only as a keyed hash).
• Invitation only. A person gets in only if an administrator has invited their address. Access is decided on every request on our servers, not by what the screen shows.
• Roles. Each person has a role that limits what they can see and do. A role change applies at their next request.
• Sessions are signed, last 12 hours, and are sent only over HTTPS.

Separation between customers

• Each customer has its own workspace with its own people, connections, data and recordings. Data is separated in the database and in file storage, and automated tests create two workspaces and check that neither can read, change or list anything of the other.
• Our platform administrators can create a workspace and see how many people it has and who its first administrator is. They cannot open a workspace or read its content.

Protecting data

• In transit: all traffic uses HTTPS (TLS).
• At rest: hosted in Google Cloud in the EU, encrypted by the platform. Jira connection tokens (in both products) and Magnesia recordings and transcripts are additionally encrypted by the application with AES-256-GCM. GitHub access tokens used by Magnesia are short-lived and never stored.
• Secrets (keys, client secrets) are kept in Google Secret Manager, never in code, and the service refuses to start in production without them. Secrets are never written to logs.
• Storage buckets are private. Recordings are encrypted before they are stored; the temporary copy made for transcription is deleted when it is done.
• Jira and GitHub access is least-privilege: Magnesia reads only; Penta creates only what a person approved, as that person.

AI

• AI runs only when a person asks, receives only what the task needs, is called over HTTPS with keys held in Secret Manager, and never changes anything itself: a person approves the result. Customer content is not used to train models. Details, retention periods and our next steps are on AI and your data.

Accountability

• An audit log records who did what and when (in Penta also from which IP address). In Penta the database itself refuses to change or remove entries; in Magnesia the application only ever adds entries. It never contains secrets or content.
• Each request carries an id so we can trace a problem without reading your content.
• Our staff do not look at content except to give support you ask for or to investigate a security problem.

Development and operations

• Changes go through automated tests and a review of each change before release, with a preview environment that uses test data, never customer data. Production releases keep the previous version ready to restore.
• Production and test environments are separate, with separate databases and secrets.
• Servers run as an unprivileged user, not root, in both products. The application files cannot be changed by the running service, and our release pipeline refuses to publish a Penta image that would run as root.
• [CONFIRM: dependency and vulnerability scanning, backups and restore tests, penetration test date, if any]

If something goes wrong

We follow a written incident procedure. We tell affected customers without undue delay (target [BREACH NOTICE, for example within 48 hours]) and report to the regulator within 72 hours where the law requires. To report a vulnerability, write to info@sepenta.io. We will not take action against good-faith research that stays within these limits: no access to others' data, no disruption, and prompt reporting.

What we do not do yet

• Automatic deletion. Content is not deleted automatically at the end of a retention period yet; it is deleted when you remove it or ask us to. The retention setting records the intended period.
• Separate encryption keys per customer. Application-level encryption uses one key for all workspaces today; a key per workspace is planned.
• Certifications. We do not hold ISO 27001 or SOC 2 certification. [CONFIRM: remove or change if this changes]