Security & trust

Tenant isolation

Isolation is tested, not assumed

Every pull request runs a two-tenant isolation suite against a real database and cache: it provisions two businesses and attempts cross-tenant access on every authenticated surface — admin sessions, customer tokens, the agent gateway, and partner API keys. A cross-tenant read anywhere fails the build.

Every tenant query is scope-checked in CI

A dedicated static gate verifies that every database query against tenant-scoped tables carries an explicit tenant filter. Row-level security policies exist on all tenant tables as an additional layer.

Data protection

Encryption in transit everywhere

All traffic is HTTPS with HSTS. Outbound calls to businesses’ own endpoints require HTTPS in production.

Integration secrets live in a vault

Third-party credentials (calendar APIs, OAuth refresh tokens, webhook signing secrets) are stored in Supabase Vault, not in application tables. Webhook signing secrets are shown once at creation and never returned again.

Logs are scrubbed, IPs are hashed

Application logs run through a redaction list covering auth headers, tokens, emails, phone numbers, and provider signatures. Agent-gateway analytics store only a truncated one-way hash of the caller IP — the raw address is never persisted.

Card data never touches Amfion

Payments and deposits run on Stripe (Connect). Checkout happens on Stripe-hosted surfaces; Amfion stores payment status, never card numbers.

Outbound requests & webhooks

Signed webhooks

Every webhook Amfion sends is HMAC-signed with a per-endpoint secret, with timestamped signatures and a documented verification recipe. Secret rotation keeps a 24-hour co-signing grace window.

SSRF screening with connect-time address pinning

Any URL a customer or partner supplies (website imports, custom-tool callbacks, webhook endpoints) is screened against private, loopback, link-local, and cloud-metadata address space — and the screening re-runs against the address DNS actually resolves to at connection time, closing DNS-rebinding attacks. Every redirect hop is re-validated.

AI agents & booking integrity

Two-phase booking for third-party agents

External AI agents can never mutate a booking in one shot. They prepare a booking (which validates and holds the slot, minting a single-use capability token whose expiry is inside the signed material), and confirm it in a second step that executes only the server-stored arguments. A capability can produce at most one booking, enforced by a database uniqueness constraint.

Least-credential links

Booking-management links handed to anonymous agents are scoped to that single booking — never to the customer’s whole appointment history. Customer portal tokens are HMAC-signed and expire.

The model cannot upgrade trust

Answer trust is computed server-side from stored verification states of the facts actually cited. Nothing the model writes — however confident — changes what the platform reports as verified.

Operational discipline

Schema changes are a ledger

Database migrations apply through a runner with per-file checksums and an append-only ledger; applied migrations are immutable. The API refuses to report ready when its build expects a newer schema than the database has — deploying ahead of migrations fails at rollout, not at midnight.

Hardened containers

Production containers run read-only with dropped Linux capabilities, constrained temp filesystems, resource limits, and health checks. Images are rebuilt and republished through CI gates only.

The site is verified as rendered

CI crawls the built marketing site and fails on broken canonicals, accidental noindex, invalid structured data, or structured data that advertises content not actually on the page.

Reporting a vulnerability

If you believe you have found a security issue, we want to hear about it and will respond promptly. Report it to security@amfionhq.com. Please include reproduction steps and do not access data that is not yours.