Security model
- Tenant isolation: tenant-scoped tables use PostgreSQL row-level security with forced policies, and application requests derive tenant identity from authenticated context.
- Authentication: invitation-only access, verified email, Google sign-in, password hashing, optional TOTP MFA, one-time recovery codes, secure HTTP-only session cookies and session revocation.
- OAuth: state validation, PKCE where supported, exact redirect validation for MCP clients, short-lived authorization codes, digest-only bearer-token storage and revocation controls.
- Encryption: TLS protects network traffic. Provider OAuth payloads and MFA secrets are encrypted before database storage. Runtime secrets are delivered through controlled secret-management/deployment systems rather than source code.
- Audit and metering: security-sensitive actions, editorial changes, invitations, connector actions and usage events are recorded with tenant and actor context.
- Data minimization: the waitlist stores a keyed hash instead of a raw network address; MCP onboarding accepts only customer-approved capsules and never receives continuing access to the customer's other AI connectors.
- Publishing boundary: MCP cannot publish, activate profiles, reveal credentials, administer users or delete data. Automatic original-post publishing has separate controls; replies remain human-reviewed suggestions.
Customer responsibilities
Use least-privilege roles, enable MFA for owners/editors, review sessions, connect only approved source scopes, remove former members, verify generated claims and pause publishing after material account or strategy changes.
Incident reporting
Report suspected unauthorized access or data exposure to hola@tecnicora.com with the organization, approximate time and safe diagnostic details. Do not email passwords, tokens, recovery codes or full database URLs. Tecnicora will investigate and provide legally required notices when applicable.
Assurance status
This page describes implemented controls; it does not claim SOC 2, ISO 27001, penetration-test certification, a bug-bounty program or a guaranteed hosting geography. Security and procurement questionnaires can be handled through support.