Account protection
Passwords are hashed, reset and verification links use one-time tokens, sessions are server-managed, and users can enable two-factor authentication.
Prompt Manager combines account security, workspace authorization, scoped API keys, request protections, webhook safeguards, and audit records. These controls protect everyday product workflows without implying third-party security certifications that are not listed.
Passwords are hashed, reset and verification links use one-time tokens, sessions are server-managed, and users can enable two-factor authentication.
Browser and API operations validate workspace membership and role before allowing protected reads or changes.
Modern API keys are stored as hashes, shown only at creation, scoped to capabilities, and checked against active workspace membership.
Outbound webhook targets are validated, private and local destinations are blocked by default, delivery timeouts are enforced, and payloads are signed when a secret is configured.
The application uses CSRF protection for browser forms, rate limits sensitive endpoints, secure cookie options in production, and common security response headers.
Key workspace and platform actions can create audit records so administrators can investigate operational changes.
Before production launch, use HTTPS, rotate all development credentials, use a strong session secret, restrict database/network access, configure trusted mail and payment credentials, and keep dependencies patched.
Tell us how many teams, users, workspaces, and integrations you expect so the rollout can match your operational requirements.