supercenter
← Trust Center

Security Overview

Generated from Supercenter's internal compliance program. Last reviewed: June 2026.

Architecture

  • Hosting — Vercel (serverless compute, global edge, TLS everywhere). No self-operated servers.
  • Data — Convex managed database; provider-encrypted at rest, continuously backed up.
  • Identity — WorkOS AuthKit SSO; MCP access via OAuth 2.0 + PKCE; hashed scoped API keys.
  • Tenancy — every record is organization-scoped; queries authenticate and pin the caller server-side.

Agent & AI safety (what makes us different)

  • Credential isolation — connector credentials are AES-256-GCM encrypted and resolved server-side at execution time. They never appear in prompts, tool descriptions or model-visible state.
  • Approval gates — destructive or consequential actions (send, delete, pay, post) can require human approval before execution. Approvals are actioned inside your own Slack workspace by your team (any workspace member with access to the approval card can respond); fully autonomous runs without an approval channel execute under the action policies you configure for them.
  • Sandboxed execution — agent code runs in isolated per-session microVMs with budget caps; admins can pause any agent and kill any session.
  • Delegation with consent — one user's agent can act with a colleague's credentials only after that colleague explicitly approves named actions; grants are revocable instantly and every delegated call is attributed to both parties in the audit log.
  • Full audit trail — per-session tool-call logs, admin action logs, and billing ledger.

Model providers

LLM inference runs through the Vercel AI Gateway under zero data retention. The gateway routes prompts to model providers (Anthropic, OpenAI, Google, xAI) under no-training commercial terms; these act as sub-processors of the gateway and are named under the Vercel entry in the subprocessor list below. Your content is not used to train models.

Data protection

  • TLS 1.2+ in transit, HSTS on the public origin.
  • Credentials encrypted with AES-256-GCM (versioned envelope format).
  • EU/EEA data transfers covered by SCCs / EU-US DPF per subprocessor.
  • Data subject request process with a one-month SLA (privacy contact below).

Vulnerability management

Internal security audits across auth, secrets and agent-trust surfaces; dependency and secret scanning on the repository; severity-based remediation SLAs. An external penetration test is on the certification roadmap below.

Responsible disclosure

Report vulnerabilities to the security contact on this page. We acknowledge within 2 business days and do not pursue good-faith research.