How we handle your data.
This page is maintained by the Catalyte team. It describes the controls active in the product today. It is not a certification or audit statement.
Authentication
- API keys
Bearer tokens prefixed cat_live_*. Hashed at rest with SHA-256. Revocable per key from the dashboard.
- OAuth 2.1 for MCP
PKCE S256 required. Dynamic Client Registration (RFC 7591) for any compliant client. Access and refresh tokens hashed and rotatable.
- Sign-in
Email + password and Google OAuth. Session tokens managed by the platform; no rolled-our-own JWTs.
Isolation
- Workspace scoping
Every token, request, and tool call resolves to exactly one workspace. No cross-tenant read path exists.
- Row-level security
Enforced on every public table. Roles live in a dedicated table, checked through a SECURITY DEFINER helper.
- Public Directory
Opt-in per channel. Discoverable rows flow through read-only views — never the underlying tables.
Secrets and data
- SFTP credentials
Stored in the platform's encrypted Vault. Decrypted only inside the server-side push routine.
- Webhooks
HMAC-signed payloads. Verified inside route handlers before any work happens.
- Transport
HTTPS everywhere. No HTTP fallback for authenticated surfaces.
Operations
- Revocation
Disconnect Claude, kill an API key, or flip a channel off — effective immediately.
- Plan changes
Downgrades enforce limits at the database layer, not the UI.
- Logging
Structured request logs for the API and MCP surfaces. Available on request to workspace admins.
Report something
Found a vulnerability? Email hello@catalyte.dev with reproduction steps. We'll respond within two business days.
Other questions → /contact