AI SOLUTIONS
Security & privacy.
Your Command Center handles sensitive business data: leads, payments, customer conversations. Every security measure listed here is built into the system by default, not sold as an add-on.
Your data, your server
Your Command Center is its own separate deployment: its own instance, its own database, its own address. No aggregated client data, no two businesses sharing one system.
Fail-closed design
When a security check can't verify, it denies by default. Missing webhook secret? The endpoint returns 503, not a silent pass.
No training on your data
Your conversations, leads, and business data are never used to train AI models.
Authentication
Multi-user access control.
The Command Center supports multiple authenticated users with separate credentials, each secured against common attack vectors.
Bcrypt password hashing
All passwords are hashed with bcrypt before storage. Plain-text passwords never touch the database or logs.
Brute-force lockout
After 5 failed login attempts from the same IP, the account locks for 15 minutes.
Session token authentication
Successful login returns a session token; every subsequent request is authenticated against it, no credentials stored in the browser.
Secrets never echoed
API responses never return passwords or access codes. The settings endpoint reports only whether values are set, never the actual values.
Rate Limiting
Request throttling and spend caps.
Multiple layers prevent abuse, runaway costs, and denial-of-service, whether from malicious actors or accidental loops.
Public chat rate limiter
Rate-limited per IP with a short burst allowance (30 requests/IP/minute, burst 5), so a bot is throttled before it costs you anything.
Public chat volume cap
Public chat turns are hard-capped per month (300, configurable) and checked before any AI call is made. Once reached, the assistant hands off politely instead of continuing to spend.
Owner chat volume cap
A separate, higher monthly allowance (2,000, configurable) for owner-mode interactions.
Search volume cap
Live web search has its own isolated monthly allowance (50, configurable), so a research-heavy month can't eat your chat budget.
Network
CORS, origins, and API access.
Your API only talks to domains you've approved. No wildcard access, no open endpoints.
CORS whitelist
Cross-origin requests are locked to an explicit list of allowed origins: your website, your dashboard, and nothing else. No wildcard access is ever permitted.
Public tool restriction
Public chat runs on a separate, explicitly allow-listed tool set: brand Q&A, lead capture, availability lookup, live web/SEO lookups, content drafting. CRM queries, billing, memory, and job management only load in an authenticated owner session.
Gate-exempt routes
Only specific routes bypass the authentication gate: public chat, webhook receivers, the health check, and the proposal viewer. Everything else requires a valid session.
Webhooks
Webhook verification.
Every incoming webhook is authenticated before a single byte of its payload is processed.
Stripe HMAC-SHA256
Verified using HMAC-SHA256 signature matching with a 5-minute replay guard, staying safe during secret rotation.
Buildertrend shared-secret auth
Milestone webhooks authenticate against a dedicated rotating secret before any payload is read. If the secret isn't configured, the endpoint returns 503; it never silently accepts an unverified payload.
Two-step confirmation for irreversible actions
Sending a document for e-signature, creating a Stripe charge, pushing a lead to an external CRM: anything that can't be undone requires the AI to confirm with the user before executing.
Data Privacy
Where your data lives.
A clear picture of what data the system handles and where it goes.
Your CRM data
Lives in Airtable under your account: leads, conversations, settings, social posts, and assets, accessible only through authenticated API calls.
Conversations
Logged to your CRM for context continuity. The data never leaves your Airtable workspace.
Payment data
Handled entirely by Stripe. Your Command Center creates payment links and invoices through Stripe's API but never touches card numbers or bank details.
API keys and secrets
Stored as environment variables on your server. They never appear in code, logs, API responses, or cloud-synced files.
Infrastructure
Hosting and deployment.
Your system runs on managed infrastructure with automatic deployment and health monitoring.
Managed hosting
Runs on a managed cloud platform. SSL is automatic. The server restarts on failure.
GitHub auto-deploy
Every update to the main branch triggers an automatic deployment, with one-click rollback.
Health check endpoint
A dedicated endpoint reports the status of every integration: what's connected and what needs attention.
Environment isolation
Each client's Command Center is a completely separate deployment with its own server, database, API keys, and domain.
Talk to Vincent
Questions about security?
Happy to walk through the technical details. Book a call and ask anything.