Encrypted at rest
Integration tokens (Gmail OAuth, Slack, WhatsApp, etc.) are encrypted at rest using AES-256-GCM with authenticated encryption — tamper detection is built in. Legacy tokens are upgraded to the new format automatically on next use.
Security Overview
A transparent snapshot of current product safeguards and controls — self-attested, pending formal audit.
Last updated: November 1, 2026
Posture
Security posture. SpicaNova AI is built around a human-in-the-loop email workflow.
DefaultRead, score, draft, ask
The default product behavior is to read, score, draft, and ask before sending — nothing is sent automatically.
ApprovalApproval-gated by default
Everything is approval-gated by default: any action that reaches a person waits for your one-tap approval.
AuditLogged, and reversible
Every automated action is logged with the reason it was taken, so you can always review and reverse what happened.
Data protection
Data protection
Row-level security
Database access is governed by Supabase row-level security (RLS) so each user can only read and write their own data. Service-level access from background routes is scoped to the backend and never exposed to client-side requests.
Retention limits
Email body content is not retained permanently. We apply automated retention limits (email bodies 30 days; email metadata 90 days) enforced by a daily cleanup process.
Masked in our logs
Email subjects, sender/recipient addresses, and phone numbers are masked in our own logs and error-monitoring tool before storage. Sentry is configured with sendDefaultPii: false and a scrubber to prevent message content from reaching the error-monitoring pipeline.
Access controls
Access controls
We ask for the least access each job needs. For Google and Stripe: Gmail: read, label and send, but never delete mail for good. Calendar: read your events to find free times, and add, change or remove the events we create. Google Drive: only the files you hand us, unless you turn on Drive search, which is read-only. Stripe: a restricted key you create, and we ask for read-only access.
We never ask for your password and never sign in as you. We act only through the access you granted. Disconnecting Google or Slack cancels that access with them too; for other tools, you can also remove it inside that tool.
OAuth connection flows include CSRF state checks.
Slack webhook requests are HMAC signature-verified.
Cron endpoints require a bearer-token authorization header.
Development-only test routes are not exposed in production.
User-facing write actions — including sending a draft — are tied to authenticated sessions and verified integration flows.
All API routes that accept unauthenticated or semi-trusted requests (auth endpoints, webhooks, OAuth callbacks) are rate-limited by IP address using the last hop of X-Forwarded-For to prevent spoofing.
Transport and headers
Transport and headers
HTTPS and HSTS
HTTPS is enforced everywhere. HTTP Strict Transport Security (HSTS) is set on all routes.
Response headers
Security response headers are applied globally: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy restricting camera, microphone, and geolocation.
Content Security Policy
A Content Security Policy ships as two headers: the structural directives (frame-ancestors, object-src, base-uri, form-action) are enforced, and the script half stays report-only while we complete the nonce migration for Next.js inline scripts. Enforcement will be enabled once verified.
Revoked, then deleted
OAuth disconnects revoke the token at the provider (Google revoke endpoint, Slack auth.revoke) before deleting the local connection record.
Error monitoring
Error monitoring
Captured and fingerprinted
Error monitoring is live via Sentry. Every unhandled exception in the app, background functions, and webhooks is captured, fingerprinted, and logged. Repeated errors trigger an internal ops alert — new error fingerprints are surfaced immediately.
Redacted before storage
Error reports are stored in a service-role-only database table. Personal-data fields are redacted before storage and before transmission to Sentry.
Dependency audits
Dependency security audits run automatically via GitHub Actions on every push. Dependabot monitors npm dependencies weekly.
Prompt-injection defense
Prompt-injection defense
Inbound email content, fetched thread context, and third-party tool results flowing into AI prompts are wrapped in explicit trust-boundary tags and a data-not-instructions directive, so injected content in an email cannot drive outbound tool calls or send actions.
The chat agent is explicitly prohibited from taking outward or state-changing actions (sending email, scheduling meetings, or running integration tools) because a piece of content instructed it to — only the founder's own typed messages in the chat interface are treated as authoritative commands.
Self-attested, pending formal audit
Planned improvements
Everything above is a transparent snapshot of current product safeguards and controls. No third party has audited any of it yet. These are the items we know are not done, named here rather than left off the page.
CASA Tier 2
CASA Tier 2 security assessment (required for Google restricted OAuth verification) — planned via an approved assessor. A pre-scan with OWASP ZAP and securityheaders.com will run first.
Full CSP enforcement
CSP enforcement (moving from report-only to enforced) pending nonce integration.
SOC 2 Type II
SOC 2 Type II and formal audit evidence are planned for a later stage.