An AI agent driving your product should be the easiest thing in your security review.

Tenant isolation

One workspace per company

Everything you create (agents, product knowledge, sessions, audit history) is stamped with the workspace ID it belongs to and can only be read through that workspace. Delete a workspace and all of it goes with it.

The server decides which workspace you are in

Your workspace is taken from who you are signed in as, so a request cannot ask for data belonging to a different company. Guessing at someone else's ID returns nothing at all.

Membership is re-read on every request

Someone's role is checked fresh on every request. Remove a person and they lose access on their very next click, with their existing sessions ended at the same moment.

Authentication and access control

Single sign-on with OpenID Connect

Connect Okta, Microsoft Entra ID, Google Workspace, Auth0, or any OIDC provider. Sign-ins use the authorisation code flow with PKCE, and we check the signature on every token your provider sends back, so a reply cannot be forged or replayed.

Domain ownership proved by DNS

A workspace can only sign in people whose email domain it has proved it owns with a DNS record. Anyone outside that domain is refused, so another company cannot set up a workspace and quietly start signing in your staff.

Roles enforced server side

Owner, admin, member, and viewer, defined in one permission matrix that every route names. Nobody can grant a role above their own or edit someone who outranks them, and a workspace can never be left without an owner.

Passwords, when you use them

Hashed with Argon2id at 64 MiB memory cost. Sign-in answers identically for a wrong password and an unknown address, and takes the same time either way, so responses cannot be used to enumerate who has an account. Repeated failures lock the account temporarily.

You can require SSO

Turn it on and password sign-in stops working for your workspace, including for an old session that was started with one.

Sessions

Server side sessions

The cookie in your browser is a random value, and we only ever store a hash of it. Someone who got hold of the database could not use it to sign in as you, and we can end a session the moment you ask.

Absolute and idle lifetimes

Set a session lifetime for your workspace. A workspace may shorten the deployment default, never extend it. Idle sessions expire on their own.

Visible and revocable

Everyone can see every browser signed in as them, with address and last activity, and end any of them. Changing a password signs out every other browser.

Cookies are HttpOnly, SameSite, and Secure in production

State-changing requests additionally require a double-submitted CSRF token and an allowlisted origin, so a cross-site page can neither read the session nor ride it.

What the agent is allowed to do

No live product control

A session can only change screens, point, scroll, and annotate inside an immutable published capture. It cannot operate your live product or change data, because it is never connected to one.

Sandboxed local replay

The buyer renders sanitized compiled snapshots in a sandbox with network access disabled. Raw capture events are not published to buyers.

No product credentials anywhere

Capture runs in your own already-authenticated browser. There is no sign-in feature, no credential vault, and no product session to hand to a model, so there is nothing of yours for us to lose.

Reviewable before a buyer sees it

Prepared flows, approved answers, and guardrails are configuration your team can read and sign off, rather than behaviour you discover in production.

Audit and accountability

Append-only history

Sign-ins and failures, invitations, role changes, removals, security settings, SSO changes, domain verifications, publishing, and demo sessions, each with actor, target, time, and address.

Nothing edits it

The application has no path that updates or deletes an audit row. The only removal is the cascade when a workspace is deleted at your request.

Yours to export

Owners and admins can read the log in the dashboard and export it as CSV for your own review or retention.

Data handling

What we store

Your agent configuration, sanitized published captures, the company knowledge you add, workspace membership, and operational records. Live knowledge sources remain separately allowlisted and are fetched only when the agent needs them.

SSO client secrets are encrypted at rest

AES-256-GCM under a deployment key. The secret is never returned by the API in any form once saved. You rotate it, you do not read it back.

Deletion

Ask us to delete a workspace and its rows go with it. Agents you delete release their public demo links immediately.

Not yet built

We would rather you find this here than in a questionnaire. If one of these blocks a deal, tell us and it moves up.

• SAML in addition to OIDC, and SCIM directory provisioning
• Authenticator-app two-factor for password accounts
• Customer-managed encryption keys and configurable data residency
• SOC 2 Type II. We are not certified today, and we will not claim otherwise

Reporting a vulnerability

Email hello@trysparrow.ai with steps to reproduce. We acknowledge within one business day and will keep you updated until it is closed. Please do not test against another customer's workspace.