Security & trust
Built for regulated service businesses. Customer data and automations stay isolated.
Tenant isolation
Every organisation gets a dedicated automation runtime. Workflows, credentials and execution data are never shared between customers.
Row-level security
All tenant data is protected by Postgres row-level security policies enforced at the database layer.
Server-side secrets
Third-party credentials never reach the browser. Only secret reference labels are stored — values live in our secret manager.
Signed automation calls
All automation engine calls are HMAC-signed, timestamp-checked and idempotent.
Immutable audit log
Every important state change, workflow run, retry and approval is recorded immutably.
Role-based access
Granular roles for ClientAdmin, Manager / Partner, Staff and Read-only — plus a CloudOneAdmin superadmin role.