Identity and workspace access
Google is the only supported sign-in provider. In production, a verified Google identity must also match a database-backed workspace membership before private product routes are available.
Application queries include an organization identifier so records are read and changed within the selected workspace. PostgreSQL row-level security is not enabled yet, so tenant isolation currently depends on application enforcement and repository-level query scoping.
Connector and credential handling
CloseSpan uses Pipedream Connect for multi-tenant provider authorization. Pipedream stores provider credentials, and the browser receives a short-lived hosted connection flow rather than the provider credential itself.
AI provider keys entered in workspace settings are encrypted with AES-256-GCM, bound to the organization and provider, masked in the interface, and not returned to the browser after storage. Deployment-managed provider keys can also be used by the server.
AI and customer-content boundaries
- Feedback text is treated as untrusted evidence, not as agent instruction.
- Supported AI analysis runs use bounded structured output and do not grant the model tools.
- Text preprocessing detects and redacts common secrets and personal identifiers before supported model analysis.
- Model-run records, proposed analyses, and review decisions are stored within the workspace scope.
- A model proposal does not directly merge feedback into a product problem without human review.
Actions, auditability, and current limitations
Workflow mutations use request validation, tenant checks, idempotency keys, and audit records. The current GitHub external-work-item path is simulated, not a live GitHub issue or pull-request action.
Production gates that remain open include database row-level security, complete retention and deletion workflows, production audit export, background connector workers, and provider-specific imports beyond the current Zendesk manual pull. These gaps should be resolved before broad use with sensitive customer data.
- Implemented
- Google identity, membership checks, tenant-scoped queries, Pipedream-hosted authorization, redaction, encrypted AI keys, and audit events
- Not claimed
- SOC 2, ISO 27001, HIPAA, PCI DSS, or independent penetration-test certification
- Still required
- RLS defense in depth, complete lifecycle controls, worker hardening, and broader connector verification
Report a security concern
Send a concise report to [email protected] with the affected URL, reproduction steps, observed impact, and a safe proof of concept. Do not include live credentials or private customer records. No public bug-bounty program or guaranteed response time is currently offered.