Security

Every table is scoped to a workspace and protected by Postgres row-level security. Members only see workspaces they belong to; privileged operations verify roles server-side.

Connected API keys and OAuth tokens live in a deny-all vault table that browsers can never read. Values are write-only from the UI and decrypted server-side only at call time. Platform API keys are stored as SHA-256 hashes.

All traffic is TLS. Hosting on Vercel, data on Supabase (encrypted at rest), payments on Stripe (PCI-DSS). Internal service endpoints require signed secrets; cron endpoints require a bearer secret.

Agents act only with the tools and connections you grant per workspace. Outbound actions that matter (ads going live, content posting) require explicit human approval in the dashboard.

Every agent run is logged with provider, model, token usage, and cost — exportable as CSV from Settings.

Found a vulnerability? Email hello@businessmcp.com — we respond within one business day.