Security & trust
Security is a product requirement
Ayonix Marketing Agent isolates every organization's data, encrypts marketplace tokens, enforces capability-based access on the server, verifies webhooks, and audits every sensitive action.
Tenant isolation
Organization-scoped data access that fails closed, with cross-tenant tests.
Encrypted tokens
AES-GCM with key versioning; secrets never committed or logged.
Capability-based auth
Server-enforced permissions on every request and queue consumer.
Webhook verification
Signatures validated before parsing content.
SSRF guard
Outbound fetches block private-network and metadata endpoints.
Auditability
Auth, membership, token, connector, autonomy, approval, and publishing events are logged.
FAQ
Frequently asked questions
How is my data isolated?+
Every tenant-owned record carries an organization id, and data access fails closed without an organization context. Cross-tenant isolation is covered by automated tests.
How are marketplace tokens protected?+
Access and refresh tokens are encrypted with AES-GCM using a versioned key derived from an operator secret, and are never logged.
Do you verify webhooks?+
Yes. Webhook signatures are verified before any business content is parsed.