Security and privacy: overview

• Authentication — you must be signed in for any private request.
• Authorization — identity, workspace, role and resource permission must all permit the read.
• Workspace isolation — context never crosses a workspace boundary.
• Credential protection — provider tokens are encrypted at rest and never placed in a prompt.
• Input guardrails — attempts to override system behaviour are rejected.
• Output guardrails — internal reasoning and sensitive tokens are stripped before a response is shown.

• Your conversations, stored in OpenbirdAI so history and follow-ups work.
• Your workspace memory, stored per workspace.
• Provider data, which stays with the provider; OpenbirdAI reads it under your authorisation.
• Request telemetry, used to operate and improve the product and retained in bounded form.

• Ask you for a provider password or token.
• Share one account's data with another.
• Give a model raw database access.
• Publish private content in public indexes or machine-readable exports.

If you believe you have found a vulnerability or a data exposure, stop using the affected flow, revoke the relevant session or connection, and report it with what happened, when, and which workspace was involved. Do not include credentials or tokens in the report.

• That a private-data question returns unavailable without a connection.
• That another user's conversation is not reachable from your account.
• That a workspace cannot read another workspace's memory.
• That a connected document cannot instruct OpenFeather to reveal data.

These checks use only your own account and are safe to run. If any of them fails, stop and report it rather than continuing to test.