SECURITY

Enterprise security.
Full transparency.

MarketingOS protects your data with encryption, strict tenant isolation, role-based access, and complete audit trails. Human approval gates ensure no AI agent acts without your consent.

Encryption at rest & in transit

Data protection

All data encrypted with TLS 1.2+ in transit. OAuth tokens encrypted with AES-256-GCM. Connector credentials secured with Fernet symmetric encryption.

Strict multi-tenant isolation

Isolation

Every database query is scoped by tenant ID. No cross-tenant data access is possible. Row-level security enforced throughout the entire stack.

Human approval gates

AI safety

No AI agent can spend money, publish content, or take external action. Every recommendation requires explicit human approval with budget impact, risk assessment, and evidence.

Role-based access control

Access control

6 distinct roles (super_admin, agency_operator, client_admin, client_member, approver, readonly) with granular permissions. Operator and client portals separated at middleware and API level.

Complete audit trail

Accountability

Every state change logged with actor, action, target, and timestamp. Agent execution logs track model, tokens, duration, and confidence for every specialist run.

AI transparency & provenance

Transparency

Per-section confidence scores, data source labeling, mock vs. live indicators, and full agent provenance. Users see exactly what data each recommendation is based on.

Rate limiting & input validation

Defense

Authentication endpoints rate-limited to 20 requests per 60 seconds per IP. All inputs validated with Pydantic schemas and regex patterns. No arbitrary string injection.

Secrets management

Credential safety

No secrets stored in code. Environment-based configuration. API keys, OAuth tokens, and connector credentials encrypted at the application layer with Fernet.

Honest security posture

JWT tokens are currently stored in localStorage (not HTTP-only cookies). There is no CSRF protection yet. Token refresh is not automated. The encryption key is application-level (not KMS-backed in production yet). These are documented in docs/SECURITY.md and planned for hardening.

Questions about security?

Review our full security documentation or try the platform with demo data.

Get Started →Try Demo Portal