Trust Center

ThothOS is multi-tenant B2B software, so trust is the product. This page pre-answers the security questions buyers ask (the CAIQ/SIG set) with what we actually do today — every control below is enforced in code and, where noted, continuously verified by an automated test gate. For the legal terms see our DPA, Privacy Policy, and Sub-processor list.

Tenant isolation (can company A ever see company B’s data?)

• One identity chokepoint.Every request passes through a single middleware that is the only place permitted to assert who you are; a prior identity-forgery vector was found and closed.
• Per-tenant scoping at the data layer. Every data resolver is confined to the caller’s own company — a user in one company cannot reach another’s data even with a forged request.
• Verified continuously: a Playwright role-matrix suite exercises dashboard route × role access (generated under tests/playwright/role-matrix/), and a cross-tenant isolation guard suite runs in CI. Counts and pass/fail are taken from the live suite — not a hand-typed marketing number.
• Isolation regressions are caught in CI — static guards and the role-matrix suite run in the check workflow. (They are not yet a hard required status check on every merge; see launch plan branch-protection work.)

Encryption & key management

• Encryption in transit (HTTPS/TLS) everywhere.
• Encryption at rest for personal identity data (email, phone, address) with searchable blind indexes.
• Field encryption uses versioned keys — keys can be rotated without re-exposing or losing data.
• Session tokens are stored only as SHA-256 hashes, never in clear text.

Access control & authentication

• Role-based access control (RBAC) enforced per employee within each company.
• Multi-factor authentication (MFA) available.
• Sessions validated server-side on every request.

Audit logging

• Tamper-evident, hash-chained audit logging with long-term archival, plus an automated chain-verification job.

AI & your data

ThothOS does not use your data to train, fine-tune, or improve any AI model. AI features run on third-party model providers (e.g. Anthropic) as sub-processors under agreements that prohibit training on API-submitted data. Full terms: DPA.

Data lifecycle — retention, export, deletion

• Export: a whole-company data export is available (credential/ secret collections are excluded by design).
• Deletion: deleting a company cascades across all of its data as a guarded, coverage-checked operation; the audit trail is retained for compliance.

Reliability & monitoring

• A dependency-aware deep health probe (database, payments, application) backs the readiness check.
• A readiness monitor runs every 15 minutes against the live surface and posts an alert on regression when OBSERVABILITY_WEBHOOK_URL is configured (otherwise the regression is loud-logged on the server).

Compliance posture

SOC 2-aligned controls (the isolation, encryption, audit-logging, and access controls above) are implemented, and regressions against them are exercised by the check workflow in CI. That workflow is not yet a hard required status check on every merge, and the production build itself runs no guards — so treat CI coverage, not the build, as the enforcement point. A formal SOC 2 Type II audit has not yet commenced; a completed CAIQ/SIG is furnished to prospective customers on request.

Report a vulnerability

Email security@thothos.net. We acknowledge and respond promptly. A completed security questionnaire (CAIQ/SIG) and the DPA are available to prospective customers on request.