Security

Boundaries you can inspect.

This page separates controls that exist in the code from things a public beta has no business claiming. Vendor certifications belong to the vendor, not to us.

Implemented today

ControlHow it worksState

Tenant scopingEvery read and write is keyed to the authenticated company. An id from another workspace reads as missing, not as forbidden.In code

Role-based accessOwner, admin, operator, and viewer carry explicit capabilities, checked server-side on every mutation.In code

Session boundarySessions are server-side records with an expiry. A suspended or revoked member keeps the cookie but loses all access.In code

Credential isolationProvider tokens are held by the connector broker. They never enter Firestore, a prompt, or a client response.In code

Cell isolationA workspace without a provisioned Cell gets an adapter that refuses every operation. It cannot read another tenant's runtime or screen.In code

Webhook verificationInbound WhatsApp payloads are HMAC-verified against the Meta app secret, deduplicated by message id, and dropped outside a replay window.In code

Channel routingInbound messages route by the provider's business-number id to an explicitly bound company. An unrouted number is dropped, never defaulted.In code

Approval gatesConsequential actions create an approval record that a person must decide before the run continues.In code

Append-only ledgerCredit movements are append-only with idempotency keys, so a retried request cannot double-charge or double-refund.In code

Export and deletionAny workspace can export everything it owns and record a deletion request that pauses the workspace.In code

Not claimed

AreaWhere it actually standsState

Third-party auditNo SOC 2, ISO 27001, or penetration-test report exists for fist.chat. Infrastructure vendors carry their own certifications; those are not ours.Not available

Customer-managed keysEncryption keys are managed by the underlying platform providers, not by your company.Not available

Per-workspace egress controlOutbound network policy is set at the platform level, not per workspace.Not available

Uptime commitmentThe beta has no SLA. Availability targets arrive with general availability.Not available

Data residency choiceRecords live where the platform providers place them. Region selection is not offered.Not available

Reporting a vulnerability

Send findings to security@fist.chat with enough detail to reproduce. We will confirm receipt, tell you what we found, and say plainly if we disagree. There is no bounty programme during the beta.

Subprocessors

The platform runs on hosting, authentication and datastore, model, and connector-broker providers. Each holds data on our behalf under their own terms. A current list is available on request while the public page is being prepared.

Your data

Every workspace can export its records as a single JSON file and record a deletion request from Settings. A deletion request pauses the workspace immediately; erasure is carried out as an operator task and the request stays open until it completes.