Isolation. OAuth.
Audit.
Catalyte is built for catalogs you can't afford to leak. Every read and write is scoped to one workspace by row-level security, every external integration goes through OAuth 2.1 or hashed API keys, and every secret lives in Vault.
Workspace isolation
Postgres row-level security on every table. There is no cross-tenant read path — the database itself refuses.
OAuth 2.1 + PKCE + DCR
Claude, ChatGPT, and any MCP client register dynamically and authorize per-workspace. No shared secrets in the browser.
Hashed credentials
Access tokens, refresh tokens, and API keys are SHA-256 hashed at rest. SFTP credentials live in Vault.
Role separation
Members, admins, and machine API keys are distinct principals. Privileged server functions verify the caller every time.
The MCP surface, with consent.
When an agent connects to your workspace, the user sees a consent screen listing the tools that will be granted. Tokens are revocable at any time from the dashboard. Connections show the last-used timestamp.
MCP architectureWant the full breakdown?
The dedicated trust page walks through every control — what we store, how it's hashed, who can read it, and what we don't claim.
Security posture